511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b

Analysis

max time kernel
149s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/09/2026, 23:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
Size 5.7MB
Sample260917-3kft2a1cqa
SHA256 511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b
MD5 19d897b6b6c1040c7f8a1ba241fc069b
SHA1 fd5198f8d4d78dd209c5fd1231238e305221a28e
SHA512 748d1a4fea599a12ed680c1c606434ba85f2b64b77ae1526a14ff056a2409e7e926d9618cae0a18ccf095098eba0cf4a2ef8c23b57ac9f762f4b46ff02686877
SSDEEP 98304:iLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLL8:0jJu
TLSH
T12F56E08193D9A479E5C3163450B38FCBE7697461E7218B4F906402FDEDC02E5AE2AFB4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
1084	Logo1_.exe
2684	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
2312	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
2320	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
124	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
5964	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
2076	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
984	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
4480	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
3828	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
5060	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
5668	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
1988	Logo1_.exe
716	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
944	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
5772	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
5860	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
1488	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
1928	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
1788	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
1884	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
3936	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
5792	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
4884	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
5220	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
4396	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
5640	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
5712	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
3332	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
5380	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
4108	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
928	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
5064	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
5704	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
5840	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
1584	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
912	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
5052	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
1604	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
1640	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
4840	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
5140	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
3312	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
1140	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
6060	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
1276	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
1268	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
2100	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
5984	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
5536	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
1892	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
2396	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
3488	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
4672	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
4148	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
3292	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
1308	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
2180	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
2936	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
1732	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
5724	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
2416	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
3764	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
1904	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe

Enumerates connected drives 3 TTPs 42 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\D:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\D:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\_desktop.ini	Logo1_.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Internet Explorer\SIGNUP\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSIPC\sr-Latn-RS\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SPRING\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\Client\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Mozilla Firefox\uninstall\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\STRTEDGE\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\_desktop.ini	Logo1_.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CAPSULES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft.NET\ADOMD.NET\130\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ro\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\Heartbeat\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\JOURNAL\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\Integration\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSIPC\sv\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\NETWORK\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jre-1.8\legal\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jre-1.8\lib\security\policy\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\VBA\VBA6\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\Bibliography\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\PIXEL\_desktop.ini	Logo1_.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Library\SOLVER\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSIPC\pt-BR\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\DEEPBLUE\_desktop.ini	Logo1_.exe
File created	C:\Program Files\dotnet\host\fxr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\legal\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\_desktop.ini	Logo1_.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000049\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Web Server Extensions\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\_desktop.ini	Logo1_.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\hr\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\Stationery\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\ECHO\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\rsod\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TRANSLAT\FREN\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft.NET\ADOMD.NET\_desktop.ini	Logo1_.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\Logo1_.exe	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
File created	C:\Windows\Logo1_.exe	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
File created	C:\Windows\Logo1_.exe	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
File created	C:\Windows\Logo1_.exe	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
File created	C:\Windows\rundl132.exe	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
File created	C:\Windows\Logo1_.exe	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
File created	C:\Windows\Logo1_.exe	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
File created	C:\Windows\Logo1_.exe	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
File created	C:\Windows\Logo1_.exe	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
File created	C:\Windows\Logo1_.exe	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
File created	C:\Windows\Logo1_.exe	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
File created	C:\Windows\Logo1_.exe	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
File created	C:\Windows\Logo1_.exe	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
File created	C:\Windows\Logo1_.exe	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
File created	C:\Windows\Logo1_.exe	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
File created	C:\Windows\Logo1_.exe	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
File created	C:\Windows\Logo1_.exe	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
File created	C:\Windows\Logo1_.exe	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
File created	C:\Windows\Logo1_.exe	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
File created	C:\Windows\Logo1_.exe	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
File created	C:\Windows\Logo1_.exe	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
File created	C:\Windows\Logo1_.exe	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
File created	C:\Windows\Logo1_.exe	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
File created	C:\Windows\Logo1_.exe	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
File created	C:\Windows\Logo1_.exe	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
File created	C:\Windows\Logo1_.exe	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
File created	C:\Windows\Logo1_.exe	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
File created	C:\Windows\Logo1_.exe	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
File created	C:\Windows\Logo1_.exe	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
File created	C:\Windows\Logo1_.exe	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
File created	C:\Windows\Logo1_.exe	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
File created	C:\Windows\Logo1_.exe	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
File created	C:\Windows\Logo1_.exe	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
File created	C:\Windows\Logo1_.exe	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
File created	C:\Windows\Logo1_.exe	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
File created	C:\Windows\Logo1_.exe	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
File created	C:\Windows\Logo1_.exe	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
File created	C:\Windows\Logo1_.exe	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
File created	C:\Windows\Logo1_.exe	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
File created	C:\Windows\Logo1_.exe	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
File created	C:\Windows\Logo1_.exe	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
File created	C:\Windows\Logo1_.exe	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
File created	C:\Windows\Logo1_.exe	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
File created	C:\Windows\Logo1_.exe	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
File created	C:\Windows\Logo1_.exe	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
File created	C:\Windows\Logo1_.exe	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
File created	C:\Windows\Logo1_.exe	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
File created	C:\Windows\Logo1_.exe	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
File created	C:\Windows\Logo1_.exe	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
File created	C:\Windows\Logo1_.exe	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
File created	C:\Windows\Logo1_.exe	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
File created	C:\Windows\Logo1_.exe	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
File created	C:\Windows\Logo1_.exe	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
File opened for modification	C:\Windows\Logo1_.exe	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
File created	C:\Windows\Logo1_.exe	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
File created	C:\Windows\Logo1_.exe	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
File created	C:\Windows\Logo1_.exe	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
File created	C:\Windows\Logo1_.exe	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
File created	C:\Windows\Logo1_.exe	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
File created	C:\Windows\Logo1_.exe	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
File created	C:\Windows\Logo1_.exe	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
File created	C:\Windows\Logo1_.exe	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
File created	C:\Windows\Logo1_.exe	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
File created	C:\Windows\Logo1_.exe	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe

Executes a command shell one-liner 1 TTPs 64 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5284	cmd.exe
1184	cmd.exe
2632	cmd.exe
5500	cmd.exe
3860	cmd.exe
2676	cmd.exe
3304	cmd.exe
2508	cmd.exe
3568	cmd.exe
6100	cmd.exe
5760	cmd.exe
4324	cmd.exe
1048	cmd.exe
3232	cmd.exe
1280	cmd.exe
5796	cmd.exe
5520	cmd.exe
1368	cmd.exe
2716	cmd.exe
2804	cmd.exe
3928	cmd.exe
1364	cmd.exe
2308	cmd.exe
920	cmd.exe
4540	cmd.exe
4564	cmd.exe
4316	cmd.exe
2560	cmd.exe
4848	cmd.exe
1972	cmd.exe
5928	cmd.exe
2812	cmd.exe
2428	cmd.exe
792	cmd.exe
5780	cmd.exe
1336	cmd.exe
2468	cmd.exe
3432	cmd.exe
3020	cmd.exe
828	cmd.exe
4560	cmd.exe
1512	cmd.exe
2604	cmd.exe
1872	cmd.exe
4924	cmd.exe
4076	cmd.exe
5528	cmd.exe
2744	cmd.exe
1056	cmd.exe
1388	cmd.exe
2184	cmd.exe
1376	cmd.exe
3380	cmd.exe
1360	cmd.exe
5872	cmd.exe
4140	cmd.exe
4472	cmd.exe
3024	cmd.exe
4948	cmd.exe
4896	cmd.exe
2656	cmd.exe
2232	cmd.exe
2552	cmd.exe
3664	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
6124	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
6124	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
6124	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
6124	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
6124	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
6124	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
6124	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
6124	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
6124	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
6124	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
6124	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
6124	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
6124	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
6124	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
6124	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
6124	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
6124	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
6124	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
1084	Logo1_.exe
1084	Logo1_.exe
1084	Logo1_.exe
1084	Logo1_.exe
1084	Logo1_.exe
1084	Logo1_.exe
1084	Logo1_.exe
1084	Logo1_.exe
1084	Logo1_.exe
1084	Logo1_.exe
1084	Logo1_.exe
1084	Logo1_.exe
1084	Logo1_.exe
1084	Logo1_.exe
1084	Logo1_.exe
1084	Logo1_.exe
1084	Logo1_.exe
1084	Logo1_.exe
1084	Logo1_.exe
1084	Logo1_.exe
1084	Logo1_.exe
1084	Logo1_.exe
1084	Logo1_.exe
1084	Logo1_.exe
1084	Logo1_.exe
1084	Logo1_.exe
1084	Logo1_.exe
1084	Logo1_.exe
1084	Logo1_.exe
1084	Logo1_.exe
1084	Logo1_.exe
1084	Logo1_.exe
1084	Logo1_.exe
1084	Logo1_.exe
1084	Logo1_.exe
1084	Logo1_.exe
1084	Logo1_.exe
1084	Logo1_.exe
1084	Logo1_.exe
1084	Logo1_.exe
1084	Logo1_.exe
1084	Logo1_.exe
1084	Logo1_.exe
1084	Logo1_.exe
5668	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
5668	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 6124 wrote to memory of 3304	6124	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe	88
PID 6124 wrote to memory of 1084	6124	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe	89
PID 1084 wrote to memory of 1316	1084	Logo1_.exe	91
PID 1316 wrote to memory of 1460	1316	net.exe	93
PID 3304 wrote to memory of 2684	3304	cmd.exe	94
PID 2684 wrote to memory of 1376	2684	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe	95
PID 1376 wrote to memory of 2312	1376	cmd.exe	97
PID 2312 wrote to memory of 684	2312	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe	98
PID 684 wrote to memory of 2320	684	cmd.exe	100
PID 2320 wrote to memory of 3232	2320	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe	101
PID 3232 wrote to memory of 124	3232	cmd.exe	103
PID 124 wrote to memory of 5284	124	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe	104
PID 5284 wrote to memory of 5964	5284	cmd.exe	106
PID 5964 wrote to memory of 1636	5964	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe	107
PID 1636 wrote to memory of 2076	1636	cmd.exe	109
PID 2076 wrote to memory of 3380	2076	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe	110
PID 3380 wrote to memory of 984	3380	cmd.exe	112
PID 984 wrote to memory of 4948	984	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe	113
PID 4948 wrote to memory of 4480	4948	cmd.exe	115
PID 4480 wrote to memory of 2232	4480	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe	116
PID 2232 wrote to memory of 3828	2232	cmd.exe	118
PID 3828 wrote to memory of 6140	3828	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe	119
PID 6140 wrote to memory of 5060	6140	cmd.exe	121
PID 5060 wrote to memory of 1360	5060	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe	122
PID 1360 wrote to memory of 5668	1360	cmd.exe	124
PID 5668 wrote to memory of 5812	5668	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe	125
PID 5668 wrote to memory of 1988	5668	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe	126
PID 1988 wrote to memory of 5108	1988	Logo1_.exe	128
PID 5108 wrote to memory of 5824	5108	net.exe	130
PID 5812 wrote to memory of 716	5812	cmd.exe	131
PID 716 wrote to memory of 1696	716	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe	132
PID 1696 wrote to memory of 944	1696	cmd.exe	134
PID 944 wrote to memory of 3448	944	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe	135
PID 3448 wrote to memory of 5772	3448	cmd.exe	137
PID 5772 wrote to memory of 1336	5772	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe	138
PID 1336 wrote to memory of 5860	1336	cmd.exe	140
PID 5860 wrote to memory of 5104	5860	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe	141
PID 5104 wrote to memory of 1488	5104	cmd.exe	143
PID 1488 wrote to memory of 1280	1488	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe	144
PID 1280 wrote to memory of 1928	1280	cmd.exe	146
PID 1928 wrote to memory of 4540	1928	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe	147
PID 4540 wrote to memory of 1788	4540	cmd.exe	149
PID 1788 wrote to memory of 3876	1788	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe	150
PID 3876 wrote to memory of 1884	3876	cmd.exe	152
PID 1884 wrote to memory of 4088	1884	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe	153
PID 4088 wrote to memory of 3936	4088	cmd.exe	155
PID 3936 wrote to memory of 2332	3936	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe	156
PID 2332 wrote to memory of 5792	2332	cmd.exe	158
PID 5792 wrote to memory of 4576	5792	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe	159
PID 4576 wrote to memory of 4884	4576	cmd.exe	161
PID 4884 wrote to memory of 2508	4884	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe	162
PID 2508 wrote to memory of 5220	2508	cmd.exe	164
PID 5220 wrote to memory of 5872	5220	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe	165
PID 5872 wrote to memory of 4396	5872	cmd.exe	167
PID 4396 wrote to memory of 1184	4396	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe	168
PID 1184 wrote to memory of 5640	1184	cmd.exe	170
PID 5640 wrote to memory of 4872	5640	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe	171
PID 4872 wrote to memory of 5712	4872	cmd.exe	173
PID 5712 wrote to memory of 1972	5712	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe	174
PID 1972 wrote to memory of 3332	1972	cmd.exe	176
PID 3332 wrote to memory of 3176	3332	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe	177
PID 3176 wrote to memory of 5380	3176	cmd.exe	179
PID 5380 wrote to memory of 5928	5380	511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe	180
PID 5928 wrote to memory of 4108	5928	cmd.exe	182

C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
"C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:6124
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2BD9.bat
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3304
- - C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
    "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2684
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2F05.bat
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1376
    - - C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2312
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a32ED.bat
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:684
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        7⤵
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of WriteProcessMemory
        
        PID:2320
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3697.bat
        8⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3232
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:124
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a39A4.bat
        10⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:5284
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        11⤵
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of WriteProcessMemory
        
        PID:5964
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3CA2.bat
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:1636
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2076
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3FCE.bat
        14⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:3380
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        15⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:984
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4358.bat
        16⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4948
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4480
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4ACB.bat
        18⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:2232
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        19⤵
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of WriteProcessMemory
        
        PID:3828
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4E36.bat
        20⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:6140
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5060
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a50F5.bat
        22⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1360
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        23⤵
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:5668
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5460.bat
        24⤵
        Suspicious use of WriteProcessMemory
        
        PID:5812
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        25⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:716
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5886.bat
        26⤵
        Suspicious use of WriteProcessMemory
        
        PID:1696
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        27⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:944
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5AF7.bat
        28⤵
        Suspicious use of WriteProcessMemory
        
        PID:3448
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        29⤵
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of WriteProcessMemory
        
        PID:5772
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5E04.bat
        30⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:1336
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        31⤵
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of WriteProcessMemory
        
        PID:5860
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a60D3.bat
        32⤵
        Suspicious use of WriteProcessMemory
        
        PID:5104
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        33⤵
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of WriteProcessMemory
        
        PID:1488
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6383.bat
        34⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:1280
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        35⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1928
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6613.bat
        36⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4540
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        37⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1788
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6901.bat
        38⤵
        Suspicious use of WriteProcessMemory
        
        PID:3876
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        39⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1884
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6B91.bat
        40⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4088
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        41⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3936
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6C9B.bat
        42⤵
        Suspicious use of WriteProcessMemory
        
        PID:2332
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        43⤵
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of WriteProcessMemory
        
        PID:5792
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6D95.bat
        44⤵
        Suspicious use of WriteProcessMemory
        
        PID:4576
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        45⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4884
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6E8F.bat
        46⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2508
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        47⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5220
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6F6A.bat
        48⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:5872
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        49⤵
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of WriteProcessMemory
        
        PID:4396
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7064.bat
        50⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:1184
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        51⤵
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of WriteProcessMemory
        
        PID:5640
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a719C.bat
        52⤵
        Suspicious use of WriteProcessMemory
        
        PID:4872
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        53⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5712
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a72A6.bat
        54⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:1972
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        55⤵
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of WriteProcessMemory
        
        PID:3332
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a73A0.bat
        56⤵
        Suspicious use of WriteProcessMemory
        
        PID:3176
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        57⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5380
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a747A.bat
        58⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:5928
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        59⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4108
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7555.bat
        60⤵
        
        PID:2980
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        61⤵
        Executes dropped EXE
        
        PID:928
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7620.bat
        62⤵
        
        PID:5788
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        63⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:5064
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a770B.bat
        64⤵
        
        PID:712
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        65⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:5704
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7814.bat
        66⤵
        
        PID:2224
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        67⤵
        Executes dropped EXE
        
        PID:5840
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a78EF.bat
        68⤵
        System Location Discovery: System Language Discovery
        
        PID:5408
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        69⤵
        Executes dropped EXE
        
        PID:1584
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a79F9.bat
        70⤵
        
        PID:4352
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        71⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:912
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7B12.bat
        72⤵
        Executes a command shell one-liner
        
        PID:4564
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        73⤵
        Executes dropped EXE
        
        PID:5052
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7C1C.bat
        74⤵
        
        PID:5180
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        75⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:1604
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7DD1.bat
        76⤵
        
        PID:3768
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        77⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1640
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7E9C.bat
        78⤵
        
        PID:704
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        79⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4840
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7F87.bat
        80⤵
        
        PID:3412
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        81⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:5140
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8052.bat
        82⤵
        Executes a command shell one-liner
        
        PID:4140
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        83⤵
        Executes dropped EXE
        
        PID:3312
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a811D.bat
        84⤵
        System Location Discovery: System Language Discovery
        
        PID:5416
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        85⤵
        Executes dropped EXE
        
        PID:1140
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8226.bat
        86⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:2604
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        87⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:6060
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8330.bat
        88⤵
        
        PID:1160
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        89⤵
        Executes dropped EXE
        
        PID:1276
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a83EC.bat
        90⤵
        
        PID:796
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        91⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:1268
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8488.bat
        92⤵
        
        PID:5952
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        93⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:2100
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8543.bat
        94⤵
        Executes a command shell one-liner
        
        PID:2812
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        95⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:5984
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a85EF.bat
        96⤵
        
        PID:3192
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        97⤵
        Executes dropped EXE
        
        PID:5536
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a86AB.bat
        98⤵
        
        PID:3456
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        99⤵
        Executes dropped EXE
        
        PID:1892
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8766.bat
        100⤵
        System Location Discovery: System Language Discovery
        
        PID:2976
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        101⤵
        Executes dropped EXE
        
        PID:2396
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8851.bat
        102⤵
        
        PID:4572
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        103⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:3488
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a890C.bat
        104⤵
        
        PID:2496
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        105⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:4672
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a89D7.bat
        106⤵
        
        PID:2920
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        107⤵
        Executes dropped EXE
        
        PID:4148
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8A93.bat
        108⤵
        Executes a command shell one-liner
        
        PID:1872
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        109⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3292
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8BAC.bat
        110⤵
        
        PID:3980
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        111⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:1308
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8C96.bat
        112⤵
        
        PID:5376
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        113⤵
        Executes dropped EXE
        
        PID:2180
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8D42.bat
        114⤵
        Executes a command shell one-liner
        
        PID:2632
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        115⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2936
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8E3C.bat
        116⤵
        Executes a command shell one-liner
        
        PID:5760
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        117⤵
        Executes dropped EXE
        
        PID:1732
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8EF8.bat
        118⤵
        Executes a command shell one-liner
        
        PID:4472
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        119⤵
        Executes dropped EXE
        
        PID:5724
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8FF2.bat
        120⤵
        Executes a command shell one-liner
        
        PID:5796
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        121⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:2416
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a909E.bat
        122⤵
        Executes a command shell one-liner
        
        PID:4316
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        123⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:3764
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9169.bat
        124⤵
        
        PID:6116
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        125⤵
        Executes dropped EXE
        
        PID:1904
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9263.bat
        126⤵
        Executes a command shell one-liner
        
        PID:2428
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        127⤵
        
        PID:4620
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a930F.bat
        128⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:2716
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        129⤵
        Drops file in Windows directory
        
        PID:6088
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a93CA.bat
        130⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:2744
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        131⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:5764
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9476.bat
        132⤵
        
        PID:2340
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        133⤵
        Drops file in Windows directory
        
        PID:1568
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9560.bat
        134⤵
        
        PID:2348
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        135⤵
        System Location Discovery: System Language Discovery
        
        PID:2420
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a960C.bat
        136⤵
        
        PID:3440
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        137⤵
        System Location Discovery: System Language Discovery
        
        PID:2620
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a96E7.bat
        138⤵
        
        PID:1776
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        139⤵
        
        PID:4940
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a97A2.bat
        140⤵
        System Location Discovery: System Language Discovery
        
        PID:4536
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        141⤵
        Drops file in Windows directory
        
        PID:4528
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a989C.bat
        142⤵
        
        PID:3944
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        143⤵
        
        PID:3420
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9987.bat
        144⤵
        System Location Discovery: System Language Discovery
        
        PID:4380
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        145⤵
        
        PID:3108
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9A42.bat
        146⤵
        
        PID:4264
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        147⤵
        Drops file in Windows directory
        
        PID:4116
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9ADF.bat
        148⤵
        System Location Discovery: System Language Discovery
        
        PID:5088
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        149⤵
        
        PID:3028
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9BAA.bat
        150⤵
        
        PID:3016
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        151⤵
        Drops file in Windows directory
        
        PID:4144
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9C46.bat
        152⤵
        Executes a command shell one-liner
        
        PID:2468
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        153⤵
        Drops file in Windows directory
        
        PID:5648
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9CF2.bat
        154⤵
        
        PID:4120
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        155⤵
        
        PID:2868
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9DBD.bat
        156⤵
        Executes a command shell one-liner
        
        PID:3432
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        157⤵
        
        PID:5412
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9E78.bat
        158⤵
        
        PID:4244
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        159⤵
        
        PID:856
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9F53.bat
        160⤵
        
        PID:4552
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        161⤵
        Drops file in Windows directory
        
        PID:4820
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA02E.bat
        162⤵
        Executes a command shell one-liner
        
        PID:2804
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        163⤵
        System Location Discovery: System Language Discovery
        
        PID:4400
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA0E9.bat
        164⤵
        
        PID:4992
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        165⤵
        Drops file in Windows directory
        
        PID:2900
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA1A5.bat
        166⤵
        
        PID:4188
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        167⤵
        Drops file in Windows directory
        
        PID:1112
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA260.bat
        168⤵
        
        PID:5156
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        169⤵
        
        PID:2236
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA2FD.bat
        170⤵
        
        PID:4932
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        171⤵
        Drops file in Windows directory
        
        PID:3532
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA3B8.bat
        172⤵
        Executes a command shell one-liner
        
        PID:2552
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        173⤵
        Drops file in Windows directory
        
        PID:2444
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA454.bat
        174⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:3020
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        175⤵
        Drops file in Windows directory
        
        PID:5000
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA500.bat
        176⤵
        System Location Discovery: System Language Discovery
        
        PID:3172
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        177⤵
        System Location Discovery: System Language Discovery
        
        PID:2824
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA5DB.bat
        178⤵
        
        PID:1812
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        179⤵
        Drops file in Windows directory
        
        PID:2692
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA6A6.bat
        180⤵
        Executes a command shell one-liner
        
        PID:1056
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        181⤵
        
        PID:824
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA742.bat
        182⤵
        
        PID:2988
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        183⤵
        System Location Discovery: System Language Discovery
        
        PID:2932
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA7DF.bat
        184⤵
        
        PID:2240
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        185⤵
        
        PID:5424
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA8AA.bat
        186⤵
        
        PID:3076
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        187⤵
        Drops file in Windows directory
        
        PID:4784
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA946.bat
        188⤵
        Executes a command shell one-liner
        
        PID:5500
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        189⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3516
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAA21.bat
        190⤵
        System Location Discovery: System Language Discovery
        
        PID:5196
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        191⤵
        
        PID:1312
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAABD.bat
        192⤵
        
        PID:4192
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        193⤵
        
        PID:4196
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAB59.bat
        194⤵
        
        PID:4312
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        195⤵
        Drops file in Windows directory
        
        PID:4964
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAC34.bat
        196⤵
        Executes a command shell one-liner
        
        PID:828
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        197⤵
        
        PID:5364
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aACD0.bat
        198⤵
        
        PID:5820
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        199⤵
        Drops file in Windows directory
        
        PID:4644
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAD9B.bat
        200⤵
        Executes a command shell one-liner
        
        PID:4560
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        201⤵
        
        PID:4928
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAE38.bat
        202⤵
        
        PID:1136
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        203⤵
        
        PID:2796
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAED4.bat
        204⤵
        
        PID:4136
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        205⤵
        System Location Discovery: System Language Discovery
        
        PID:4360
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAF9F.bat
        206⤵
        
        PID:4296
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        207⤵
        
        PID:3276
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB02C.bat
        208⤵
        
        PID:2044
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        209⤵
        
        PID:4936
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB0C8.bat
        210⤵
        
        PID:5832
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        211⤵
        Drops file in Windows directory
        
        PID:3324
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB183.bat
        212⤵
        Executes a command shell one-liner
        
        PID:3928
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        213⤵
        Drops file in Windows directory
        
        PID:5276
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB210.bat
        214⤵
        Executes a command shell one-liner
        
        PID:1388
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        215⤵
        
        PID:5016
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB2CC.bat
        216⤵
        Executes a command shell one-liner
        
        PID:3024
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        217⤵
        
        PID:1000
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB368.bat
        218⤵
        Executes a command shell one-liner
        
        PID:5520
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        219⤵
        Drops file in Windows directory
        
        PID:5128
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB423.bat
        220⤵
        Executes a command shell one-liner
        
        PID:2184
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        221⤵
        Drops file in Windows directory
        
        PID:2536
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB4CF.bat
        222⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:1364
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        223⤵
        
        PID:3000
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB55C.bat
        224⤵
        Executes a command shell one-liner
        
        PID:5780
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        225⤵
        Drops file in Windows directory
        
        PID:2664
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB5F8.bat
        226⤵
        System Location Discovery: System Language Discovery
        
        PID:5124
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        227⤵
        Drops file in Windows directory
        
        PID:2248
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB694.bat
        228⤵
        Executes a command shell one-liner
        
        PID:3664
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        229⤵
        
        PID:5092
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB750.bat
        230⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:2308
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        231⤵
        
        PID:3520
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB7EC.bat
        232⤵
        
        PID:2860
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        233⤵
        System Location Discovery: System Language Discovery
        
        PID:5068
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB879.bat
        234⤵
        
        PID:5404
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        235⤵
        Drops file in Windows directory
        
        PID:6012
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB915.bat
        236⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:3860
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        237⤵
        
        PID:3264
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB9D0.bat
        238⤵
        
        PID:2060
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        239⤵
        
        PID:3744
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBA6D.bat
        240⤵
        System Location Discovery: System Language Discovery
        
        PID:1864
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        241⤵
        Drops file in Windows directory
        
        PID:1652
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBB09.bat
        242⤵
        
        PID:6064
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        243⤵
        Drops file in Windows directory
        
        PID:4596
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBBB5.bat
        244⤵
        
        PID:1164
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        245⤵
        Drops file in Windows directory
        
        PID:3124
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBC51.bat
        246⤵
        
        PID:4624
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        247⤵
        System Location Discovery: System Language Discovery
        
        PID:4960
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBCED.bat
        248⤵
        
        PID:5604
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        249⤵
        
        PID:4640
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBD7A.bat
        250⤵
        
        PID:5716
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        251⤵
        
        PID:4236
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBE16.bat
        252⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:3568
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        253⤵
        
        PID:2884
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBEA3.bat
        254⤵
        Executes a command shell one-liner
        
        PID:4896
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        255⤵
        System Location Discovery: System Language Discovery
        
        PID:3852
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBF2F.bat
        256⤵
        
        PID:860
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        257⤵
        
        PID:2956
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBFCC.bat
        258⤵
        
        PID:2616
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        259⤵
        
        PID:2380
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC078.bat
        260⤵
        Executes a command shell one-liner
        
        PID:2656
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        261⤵
        Drops file in Windows directory
        
        PID:1128
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC114.bat
        262⤵
        Executes a command shell one-liner
        
        PID:2676
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        263⤵
        System Location Discovery: System Language Discovery
        
        PID:4248
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC1B0.bat
        264⤵
        
        PID:2472
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        265⤵
        
        PID:5400
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC25C.bat
        266⤵
        
        PID:2104
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        267⤵
        
        PID:5852
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC2F8.bat
        268⤵
        
        PID:4856
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        269⤵
        
        PID:4968
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC385.bat
        270⤵
        Executes a command shell one-liner
        
        PID:2560
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        271⤵
        
        PID:992
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC431.bat
        272⤵
        Executes a command shell one-liner
        
        PID:4324
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        273⤵
        
        PID:4464
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC4BD.bat
        274⤵
        Executes a command shell one-liner
        
        PID:1512
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        275⤵
        System Location Discovery: System Language Discovery
        
        PID:2944
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC55A.bat
        276⤵
        
        PID:3600
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        277⤵
        System Location Discovery: System Language Discovery
        
        PID:5228
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC5F6.bat
        278⤵
        
        PID:1524
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        279⤵
        Drops file in Windows directory
        
        PID:2872
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC673.bat
        280⤵
        Executes a command shell one-liner
        
        PID:1048
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        281⤵
        
        PID:5672
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC71F.bat
        282⤵
        
        PID:5856
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        283⤵
        
        PID:240
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC7EA.bat
        284⤵
        
        PID:2828
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        285⤵
        System Location Discovery: System Language Discovery
        
        PID:5656
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC886.bat
        286⤵
        
        PID:200
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        287⤵
        
        PID:5112
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC903.bat
        288⤵
        Executes a command shell one-liner
        
        PID:1368
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        289⤵
        
        PID:4412
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC99F.bat
        290⤵
        
        PID:5644
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        291⤵
        
        PID:4260
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCA6A.bat
        292⤵
        System Location Discovery: System Language Discovery
        
        PID:1600
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        293⤵
        Drops file in Windows directory
        
        PID:2476
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCB07.bat
        294⤵
        System Location Discovery: System Language Discovery
        
        PID:4408
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        295⤵
        
        PID:5024
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCB93.bat
        296⤵
        System Location Discovery: System Language Discovery
        
        PID:1296
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        297⤵
        Drops file in Windows directory
        
        PID:4344
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCC20.bat
        298⤵
        System Location Discovery: System Language Discovery
        
        PID:4808
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        299⤵
        
        PID:4592
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCCAD.bat
        300⤵
        Executes a command shell one-liner
        
        PID:6100
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        301⤵
        
        PID:1784
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCD39.bat
        302⤵
        System Location Discovery: System Language Discovery
        
        PID:3552
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        303⤵
        
        PID:3512
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCDC6.bat
        304⤵
        
        PID:936
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        305⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3084
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCE43.bat
        306⤵
        Executes a command shell one-liner
        
        PID:4924
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        307⤵
        Drops file in Windows directory
        
        PID:1876
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCECF.bat
        308⤵
        
        PID:1996
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        309⤵
        System Location Discovery: System Language Discovery
        
        PID:1356
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCF4C.bat
        310⤵
        
        PID:5748
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        311⤵
        
        PID:248
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCFC9.bat
        312⤵
        
        PID:3156
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        313⤵
        
        PID:1768
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD066.bat
        314⤵
        Executes a command shell one-liner
        
        PID:920
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        315⤵
        
        PID:3580
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD0E3.bat
        316⤵
        
        PID:2124
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        317⤵
        
        PID:2888
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD17F.bat
        318⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:4076
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        319⤵
        Drops file in Windows directory
        
        PID:1448
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD1FC.bat
        320⤵
        System Location Discovery: System Language Discovery
        
        PID:1452
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        321⤵
        Drops file in Windows directory
        
        PID:3760
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD298.bat
        322⤵
        Executes a command shell one-liner
        
        PID:4848
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        323⤵
        Drops file in Windows directory
        
        PID:1224
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD334.bat
        324⤵
        Executes a command shell one-liner
        
        PID:5528
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        325⤵
        
        PID:1248
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD3C1.bat
        326⤵
        
        PID:1516
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        327⤵
        
        PID:3576
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD43E.bat
        328⤵
        Executes a command shell one-liner
        
        PID:792
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        329⤵
        
        PID:4372
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD4DA.bat
        330⤵
        
        PID:5660
        
        C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\511dc076b5f1610171c4b3d03f4d0c3352e07871f5698a88603b12e64fccff3b.exe"
        331⤵
        System Location Discovery: System Language Discovery
        
        PID:4796
        
        C:\Windows\Logo1_.exe
        
        C:\Windows\Logo1_.exe
        24⤵
        Executes dropped EXE
        Enumerates connected drives
        Suspicious use of WriteProcessMemory
        
        PID:1988
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Kingsoft AntiVirus Service"
        25⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5108
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        26⤵
        
        PID:5824
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1084
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1316
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      PID:1460

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

$$a2BD9.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a2BD9.bat
Size 722B
SHA256 053a8c4d0711e25520994e92b3d6501fb7493a9fe3594eb38ca5820af9339806
MD5 2175c4f71177d0588e4c6e7ac04b91cc
SHA1 d21646080b9ede806278558d5838b5eaba246ea5
SHA512 30bae1eb89855fbb4bc5ab818a2bebd2a770bf483ad162caff771a7d9ba0dea439e90978ec58cac3e41dae813a6cab95c3f0227d7c484033120e8f47dfb3e6f7
TLSH
T16701A750E045DB7E0C5459670715654FC13A0D462FEC9625A262AEDE138252DFACB307
MD5 SHA1 SHA512 TLSH

Submit Download

$$a2F05.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a2F05.bat
Size 722B
SHA256 c4486b9767bdc3759eea255ab216af9ebc749242ee769ac220d78f4f891122d4
MD5 e2a502fa467b791d3b05e39dfa4f78ee
SHA1 f5aeede2634154d667cd40bdb155fdd02b2fc9bb
SHA512 feb840bcfa2a97d15097736f8758e323ca35aad16e66455d8a76fe134a68e6c0cf63df3148052b678fdc70fbb729701128bc2d9e98ec3f5526574b1b5d9eb975
TLSH
T15801A750E045DB7E0C5459670715654FC13A0E462FAC9626A262AEDE138293DFACB307
MD5 SHA1 SHA512 TLSH

Submit Download

$$a32ED.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a32ED.bat
Size 722B
SHA256 53a2a72213fb4ce9d7fc3eea0a8d55f7582f1015f4fb9c19ac0bf9701bfb1061
MD5 2e4fe6af1ea45bce305738720ed84c57
SHA1 4d478a4cdb1cec705afba5304b370e1cb2adf5c4
SHA512 37d7b55779a2ef1b9ac04f7c74665027c99b1864697997025c969341602d51122a1a8d85a39b9a986b6eb38bb1daa34b82197fa96734ce069d73208c659b0e84
TLSH
T14D01A750E045DB7E0C5459670B15654FC13A0E462FAC9625A262AEDE139253DFACB307
MD5 SHA1 SHA512 TLSH

Submit Download

$$a3697.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a3697.bat
Size 722B
SHA256 47e2f6a20223df72e177ff9602b656a7b29a6a7b918ff0162213f12c97172c64
MD5 000e77aff6dda130e06d1485cd82d6c0
SHA1 b43f47c2cb84943b3fd8a63a9f49867a9ad17804
SHA512 d7f2c3106dc6cde678e2274e5bc73692391f5be7f9b80039fbd8344d166a54cf54470dc5b517d3237cfaf273602aa983084bbbcbd5963e7e4c3b11ab689afa4e
TLSH
T1DC01A750E045DB7E0C5459670715654FC13A0D472FAC9625A262AEDE139252DFACB307
MD5 SHA1 SHA512 TLSH

Submit Download

$$a39A4.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a39A4.bat
Size 722B
SHA256 668584a9cd267b3a1178457bee817752d2ffc4f9d7bbc481e5189aed6c2457ec
MD5 c5b84133710d9323b325587dd8eff6f5
SHA1 c28bd44f3ac0ee2d2013bbe7e1fcbc2af6c8f3d2
SHA512 5bf98948926133183d05cc31d884f23c017d4136b2b560f62759649904c1586a44b9e35ce8aba0dfc74fd3bfacf6352e10a4e6cbc4ad5b9c395005cdac732c7c
TLSH
T12B01A750E045DB7E0C5459670B15654FC13A0D462FAC9625A262AEDE238252DFACB307
MD5 SHA1 SHA512 TLSH

Submit Download

$$a3CA2.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a3CA2.bat
Size 722B
SHA256 7c9c4295966c94355e03fcabfbf06699c8b61f1389a029c01d927d21e689502e
MD5 8bcd66874ec36a682dc1b6d729d0f35f
SHA1 0877fcf5efd5dca2a501645d8de5c1d5202996b3
SHA512 b8d5e18848d36be9d0617e596f9eb62775c982d80f6e0955d929f9f5c2134bc397bedf05ba7750fb83b96d08406a65ea264f8432573e16e46addc592e52ec1d7
TLSH
T1DB01A250E045DB7E0C549A670B15654FC23A0E462FAC9626A262AEDE238252DFACB307
MD5 SHA1 SHA512 TLSH

Submit Download

$$a3FCE.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a3FCE.bat
Size 722B
SHA256 b740c01a6f8edc11f53cf2b4046a0b1c82b3b69cb1a8726fefe1b08ca2cae90c
MD5 95e281c35e9da9390eddce14ad92e710
SHA1 b04ff28cff678867ebb19635217db71dad60c57e
SHA512 fddc3a92f2289ed8523afb36f492691fbf31d5a766154241613db78813bdc79beda699140a847989a7024f0f304fd090a33d2ad743d2ce6289a641f4a2cf75c0
TLSH
T14B01A750E045DB7E0C5459670715654FC13A0E462FAC9625A262AEDE138253DFACB307
MD5 SHA1 SHA512 TLSH

Submit Download

$$a4358.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a4358.bat
Size 722B
SHA256 4b9d943c2e3fc1bd6c3e5973d39f7065edf122204d3a3603ee2400158f15f255
MD5 48c501e90f6d776a45bdadf61e18ae8e
SHA1 618ad8a9b302edd0dd2bd4450646e275f2b40948
SHA512 471a5a23a8eabcf7fd8c1917e3ec936f39f4e65cc4ea8d94a127e59710dfda78fcc174b23e9fc245e7309de21a4b0cc4afe2c4c4a868d6412e57dac6b0b7efba
TLSH
T18701A750E045DB7E0C5459770715754FC23A0D462FAC9625A262AEDE138252DFACB307
MD5 SHA1 SHA512 TLSH

Submit Download

$$a4ACB.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a4ACB.bat
Size 722B
SHA256 b9303d2e1f9ab32a4d2dc4ad904114c6b00fa49a7304eb8d173883430dc53792
MD5 ab689095a7e373609f11d772c96a9edc
SHA1 be1069c281478f05315b8f15147d8cbc127d4d20
SHA512 e1dc8adc3cf0fe3b19122e2aacf1956ec8831fd119b7a6b170995353153d33467c9189ba8de4a65fa8934f0ba78aeb5c8540ac832e59aa2167f6dc9dc8ca93cc
TLSH
T17901A250E045DB7E0C5499670B15654FC23A0E462FACA626A262EEDE238253DFACB307
MD5 SHA1 SHA512 TLSH

Submit Download

$$a4E36.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a4E36.bat
Size 722B
SHA256 907300a06fe7d428dfd61027bed565b35a8a5f7553fe9c13f73af4443ea65b87
MD5 fa97213091952359d918db2919fb3547
SHA1 63a80731f1f37cc501c32feb9cbf202073ebf59e
SHA512 a69df19e2146a61f1ea479f6fa4022fb0453a4885a2f7e93fa8290b8c4f073b92f3bf819c0fdde4b0e551d0bfe80c6b788b25e815041d69384850217fd580be6
TLSH
T19A01A250E045DB7E0C6599770B15654FC23A0E472FAC9626A262EEDE238252DFACB307
MD5 SHA1 SHA512 TLSH

Submit Download

$$a50F5.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a50F5.bat
Size 722B
SHA256 00c03255240421b16630bd3335ac2918ed3e55c0f627f1f58671979a2381298d
MD5 5d7bfba1f2a694fbebf07e69b28aa263
SHA1 bac0d564a9201caace972c8c50b8c8076c83f73b
SHA512 02e09cfcd8939cff092df9f57a9428de36ae3d86a7516d7ae40f2fafb0917da26afb507b17eb0a47fbad569496278f47cccf367109d23983556f199190c3e249
TLSH
T1B901A750E045DB7E0C5459670715654FC23A0D462FEC9625A262AEDE138252DFACB307
MD5 SHA1 SHA512 TLSH

Submit Download

$$a5460.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a5460.bat
Size 722B
SHA256 2874e6744ddd0271a11ced622764933d67bfaf8ddaf5de0f888b84656b70dd8f
MD5 d05debd652abe0e8f6194e6f56541912
SHA1 3c2b730e2c1873b4dec19b521a1c302e1dc0c154
SHA512 eb3685ab57c531fa8b5abc1535f7ca34f3bc6beab69a40b7131436a949537aca8dff81904eda035c56d1ea958a9c0286c003654aa785369b77b2fb34ac4861ec
TLSH
T17501F210E045DB7E0C5599670B15754FC23A0E472FAC9626A262EFCE238253DFACB307
MD5 SHA1 SHA512 TLSH

Submit Download

$$a5886.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a5886.bat
Size 722B
SHA256 497d339f0313eaecbf5600fe4eb48b70ef097524ee89e89ec138e23618417263
MD5 04adf4c82624ac686df85418f3319344
SHA1 fa511a07ea1dee73c222388b559783df331fbb5f
SHA512 fdeb6c2c304b6fc8c2ea693d3eb3370579886544f4f13ce96f4c68aa52267c188dca7ae4dac19dd7651a2d54a4b4c0c79a1f33d7682cee2326493145addb43ac
TLSH
T1F301A260E045DB7E0C5499670B15754FC23A0E462FAC9626A262EEDE238252DFACB307
MD5 SHA1 SHA512 TLSH

Submit Download

$$a5AF7.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a5AF7.bat
Size 722B
SHA256 a8c176f9fdde1e131bc56d6045ca0d0fbfe1d92bddf22550c95442bafa19e4dc
MD5 bd781d7b99a68d9d7d4441e97002a3b1
SHA1 ddabd4a69b79a770e6408ba408e832fd3b090913
SHA512 9ea97ae22c6ee7204e0d3e42d2f0fa585612de880de776f243298eeb5c6594fd62e31eaeae45ef30cfeb8f8f92495f8b40b8b3067d6dcc0ecd4921ffd86b43d3
TLSH
T10C01A250E049DB7E0C5499670B15654FC23A0E462FAC9626A262AEDE238252DFACB307
MD5 SHA1 SHA512 TLSH

Submit Download

$$a5E04.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a5E04.bat
Size 722B
SHA256 2d2ad992348de41777589bced08771961d027c5da3f4b34aea94e7559d5d1e78
MD5 fef3b52b04349e28eccff52914adb4a8
SHA1 0f6046f87ef4167ab7f414487da114d35d9ea846
SHA512 e46e742a2b25882aa9520a0fe567866281c990412572dde76e64be6f353f0d1b2247435002b8d701f352344723385c02715304a63bfb0b9b5126fd5c88b79c0f
TLSH
T1B101A250E045DB7E0C5499670B15654FC23A0E462FAC9626A262AEDE238252DFACB307
MD5 SHA1 SHA512 TLSH

Submit Download

$$a60D3.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a60D3.bat
Size 722B
SHA256 06e316735b272508f399ad4e1a461a4ff8d7c9782b08b22e0fb2fab26de80112
MD5 291162f73036ce48bc97adc38d4f7377
SHA1 23fb81a629c64b5e8213bfa40f07b0cbcf64b7f6
SHA512 0fb4edc2d4315bb36f167510baf4f5aebc401bd35905e7030e5d8a1082669090d1c2308726e0e7b9a971d2f1c4d52d086846453f3a089d68e6b53b3b92f871b0
TLSH
T1C501F210E045DB7E0C549A670B15654FC23A0E462FAC9626A262AEDE238252DFACB307
MD5 SHA1 SHA512 TLSH

Submit Download

$$a6383.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a6383.bat
Size 722B
SHA256 412f905ae0a9e98a5df671686ac7776c928656e8f439935ab6b54c4ef6943520
MD5 b3e5b5fdedcb4323999ed71670021221
SHA1 1d0895ef66eb65a3ce3cb7e1efc85407a233fdd9
SHA512 001159cf2f6877446652df37a94937d20e93cc0ef797cbf7a61d91b0808e966d4ae0afb6e63debca4e21ad70c433b29cf14359420122203aa5c493cb76eeeb8c
TLSH
T1A601A750E045DB7E1C5459670715754FC13A0D462FAC9625A262EEDE138253DFACB307
MD5 SHA1 SHA512 TLSH

Submit Download

$$a6613.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a6613.bat
Size 722B
SHA256 2cff9fd90753bf8c61a0f502b0fbdc3ddfea594804ac34d192910c6318e8c306
MD5 8ee7ef470df9c5a0dd8fbe3f47a985f2
SHA1 b0a1d965f9070622a2104bf5ded869386c369413
SHA512 ec647a0fe15918e9540927c9e5268bc746c1268591ade50db9c2b64b8cabeb599f8909f249cc048c8f894a96857b6c0aaa375deee156e798cc252b3f870185de
TLSH
T1DB01A250E045DB7E0C5499670B15654FC23A0E462FAC9626A262AFDE239262DFACB307
MD5 SHA1 SHA512 TLSH

Submit Download