Analysis
- max time kernel
149s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
25/09/2026, 21:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe
- Size 7.5MB
- Sample260925-1etslaxcnf
- SHA256 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042
- MD5 f92a34c78720449fc59ae954b7ae635a
- SHA1 6eeccbbe7ae207bc15cb90ebe2bc03dfe100f248
- SHA512 40a050854d324bbd9760f27ead72c5fc497febaeaafd1cd4b0ddbfc4a707aa164c6dc18d9bccdf9f8e437b5b23ede89f88588783fcf79a4771d1eccbc325b04d
- SSDEEP 98304:iLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLo:0jJe
- TLSH T15286E18193D9A479E5C3163450B38FCBE7697461E7218B4F906402FDEDC02E5AE2AFB4
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3692 Logo1_.exe 260 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe 1512 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe 5860 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe 1348 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe 1324 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe 4852 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe 772 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe 600 Logo1_.exe 6060 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe 5872 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe 2688 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe 4476 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe 2860 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe 3760 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe 1480 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe 3040 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe 6052 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe 3732 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe 5388 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe 5992 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe 3028 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe 1184 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe 5240 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe 5188 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe 3540 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe 1992 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe 5444 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe 1308 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe 5040 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe 4264 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe 6024 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe 5228 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe 2704 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe 3796 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe 5532 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe 3440 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe 2904 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe 4224 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe 4156 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe 4180 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe 3892 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe 616 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe 5772 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe 4284 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe 4128 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe 1416 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe 4708 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe 2728 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe 472 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe 3224 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe 5880 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe 4836 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe 3252 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe 3696 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe 3288 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe 5476 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe 2316 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe 1272 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe 5996 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe 3044 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe 4196 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe 5708 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe 380 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe - Enumerates connected drives 3 TTPs 44 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe \??\F:\ Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe \??\F:\ Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\D: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\D: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\fr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CONVERT\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MEDIA\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RMNSQUE\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\1033\_desktop.ini Logo1_.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\de\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\amd64\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\gl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\WidevineCdm\_platform_specific\win_x64\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\kk\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\ro\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\zh-TW\_desktop.ini Logo1_.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\Office16\FORMS\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\zh-Hans\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Web Server Extensions\16\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\dtplugin\_desktop.ini Logo1_.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Resources\1033\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BLENDS\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\_desktop.ini Logo1_.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\IwaKeyDistribution\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Stationery\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\deploy\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Resources\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\Office16\AugLoop\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\Office16\CONVERT\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TRANSLAT\ENES\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\SystemX86\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\Updates\Apply\FilesInUse\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\27BD3A68-1D42-4278-BE21-034F6F45EA8C\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Resources\1033\_desktop.ini Logo1_.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\_desktop.ini Logo1_.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\_desktop.ini Logo1_.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ko\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Internet Explorer\en-US\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Cartridges\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\PROFILE\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\Office15\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office15\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\Office16\1036\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Library\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\sr-Cyrl-BA\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\AXIS\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1036\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\JOURNAL\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\_desktop.ini Logo1_.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\Office16\OneNote\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RICEPAPR\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Extensions\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SONORA\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\_desktop.ini Logo1_.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\Logo1_.exe 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe File created C:\Windows\Logo1_.exe 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe File created C:\Windows\Logo1_.exe 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe File created C:\Windows\Logo1_.exe 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe File created C:\Windows\Logo1_.exe 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe File created C:\Windows\Logo1_.exe 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe File created C:\Windows\rundl132.exe 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe File created C:\Windows\Logo1_.exe 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe File created C:\Windows\Logo1_.exe 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe File created C:\Windows\Logo1_.exe 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe File created C:\Windows\Logo1_.exe 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe File created C:\Windows\Logo1_.exe 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe File created C:\Windows\Logo1_.exe 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe File created C:\Windows\Logo1_.exe 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe File created C:\Windows\Logo1_.exe 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe File created C:\Windows\Logo1_.exe 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe File created C:\Windows\Logo1_.exe 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe File opened for modification C:\Windows\Logo1_.exe 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe File created C:\Windows\Logo1_.exe 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe File created C:\Windows\Logo1_.exe 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe File created C:\Windows\Logo1_.exe 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe File created C:\Windows\Logo1_.exe 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe File created C:\Windows\Logo1_.exe 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe File opened for modification C:\Windows\rundl132.exe 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe File created C:\Windows\Logo1_.exe 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe File created C:\Windows\Logo1_.exe 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe File created C:\Windows\Logo1_.exe 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe File created C:\Windows\Logo1_.exe 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe File created C:\Windows\Logo1_.exe 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe File created C:\Windows\Logo1_.exe 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe File created C:\Windows\Logo1_.exe 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe File created C:\Windows\Logo1_.exe 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe File created C:\Windows\Logo1_.exe 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe File created C:\Windows\Logo1_.exe 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe File created C:\Windows\Logo1_.exe 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe File created C:\Windows\Logo1_.exe 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe File created C:\Windows\Logo1_.exe 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe File created C:\Windows\Logo1_.exe 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe File created C:\Windows\Logo1_.exe 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe File created C:\Windows\Logo1_.exe 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe File created C:\Windows\Logo1_.exe 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe File created C:\Windows\Logo1_.exe 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe File created C:\Windows\Logo1_.exe 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe File created C:\Windows\Logo1_.exe 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe File created C:\Windows\Logo1_.exe 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe File created C:\Windows\Logo1_.exe 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe File created C:\Windows\Logo1_.exe 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe File created C:\Windows\Logo1_.exe 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe File created C:\Windows\Logo1_.exe 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe File created C:\Windows\Logo1_.exe 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe File created C:\Windows\Logo1_.exe 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe File created C:\Windows\Logo1_.exe 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe File created C:\Windows\Logo1_.exe 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe File created C:\Windows\Logo1_.exe 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe File created C:\Windows\Logo1_.exe 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe File created C:\Windows\Logo1_.exe 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe File created C:\Windows\Logo1_.exe 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe File created C:\Windows\Logo1_.exe 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe File created C:\Windows\Logo1_.exe 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe File created C:\Windows\Logo1_.exe 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe File created C:\Windows\Logo1_.exe 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe File created C:\Windows\Dll.dll Logo1_.exe File created C:\Windows\Logo1_.exe 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe File created C:\Windows\Logo1_.exe 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe - Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 1752 cmd.exe 1108 cmd.exe 4092 cmd.exe 3764 cmd.exe 5196 cmd.exe 4236 cmd.exe 5436 cmd.exe 5596 cmd.exe 2520 cmd.exe 3804 cmd.exe 3248 cmd.exe 4752 cmd.exe 3532 cmd.exe 1676 cmd.exe 5712 cmd.exe 820 cmd.exe 4788 cmd.exe 1268 cmd.exe 2608 cmd.exe 5640 cmd.exe 4776 cmd.exe 3388 cmd.exe 4316 cmd.exe 2592 cmd.exe 792 cmd.exe 1680 cmd.exe 1624 cmd.exe 948 cmd.exe 2780 cmd.exe 4312 cmd.exe 4480 cmd.exe 5276 cmd.exe 1132 cmd.exe 1148 cmd.exe 2716 cmd.exe 3552 cmd.exe 4172 cmd.exe 548 cmd.exe 4696 cmd.exe 4860 cmd.exe 4112 cmd.exe 4452 cmd.exe 2764 cmd.exe 2228 cmd.exe 4584 cmd.exe 4956 cmd.exe 4716 cmd.exe 5868 cmd.exe 5816 cmd.exe 4896 cmd.exe 4344 cmd.exe 4568 cmd.exe 4552 cmd.exe 5968 cmd.exe 2648 cmd.exe 3616 cmd.exe 2480 cmd.exe 4116 cmd.exe 5560 cmd.exe 3652 cmd.exe 1488 cmd.exe 4080 cmd.exe 2880 cmd.exe 6036 cmd.exe - Program crash 1 IoCs
pid pid_target Process procid_target 5804 3692 WerFault.exe 91 - Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname Logo1_.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain Logo1_.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname Logo1_.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain Logo1_.exe - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe - Runs net.exe
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3204 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe 3204 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe 3204 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe 3204 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe 3204 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe 3204 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe 3204 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe 3204 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe 3204 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe 3204 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe 3204 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe 3204 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe 3204 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe 3204 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe 3204 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe 3204 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe 3204 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe 3204 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe 3692 Logo1_.exe 3692 Logo1_.exe 3692 Logo1_.exe 3692 Logo1_.exe 3692 Logo1_.exe 3692 Logo1_.exe 3692 Logo1_.exe 3692 Logo1_.exe 3692 Logo1_.exe 3692 Logo1_.exe 3692 Logo1_.exe 3692 Logo1_.exe 3692 Logo1_.exe 3692 Logo1_.exe 3692 Logo1_.exe 3692 Logo1_.exe 3692 Logo1_.exe 3692 Logo1_.exe 3692 Logo1_.exe 3692 Logo1_.exe 3692 Logo1_.exe 3692 Logo1_.exe 3692 Logo1_.exe 3692 Logo1_.exe 3692 Logo1_.exe 3692 Logo1_.exe 3692 Logo1_.exe 3692 Logo1_.exe 3692 Logo1_.exe 3692 Logo1_.exe 3692 Logo1_.exe 3692 Logo1_.exe 3692 Logo1_.exe 3692 Logo1_.exe 3692 Logo1_.exe 3692 Logo1_.exe 3692 Logo1_.exe 3692 Logo1_.exe 3692 Logo1_.exe 3692 Logo1_.exe 3692 Logo1_.exe 3692 Logo1_.exe 3692 Logo1_.exe 3692 Logo1_.exe 772 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe 772 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3204 wrote to memory of 3280 3204 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe 90 PID 3204 wrote to memory of 3692 3204 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe 91 PID 3692 wrote to memory of 5948 3692 Logo1_.exe 93 PID 5948 wrote to memory of 3464 5948 net.exe 95 PID 3280 wrote to memory of 260 3280 cmd.exe 96 PID 260 wrote to memory of 3616 260 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe 97 PID 3616 wrote to memory of 1512 3616 cmd.exe 99 PID 1512 wrote to memory of 4408 1512 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe 100 PID 4408 wrote to memory of 5860 4408 cmd.exe 102 PID 5860 wrote to memory of 2520 5860 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe 103 PID 2520 wrote to memory of 1348 2520 cmd.exe 105 PID 1348 wrote to memory of 2200 1348 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe 106 PID 2200 wrote to memory of 1324 2200 cmd.exe 108 PID 1324 wrote to memory of 5712 1324 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe 109 PID 5712 wrote to memory of 4852 5712 cmd.exe 111 PID 4852 wrote to memory of 3804 4852 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe 112 PID 3804 wrote to memory of 772 3804 cmd.exe 117 PID 772 wrote to memory of 2880 772 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe 118 PID 772 wrote to memory of 600 772 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe 119 PID 600 wrote to memory of 4908 600 Logo1_.exe 121 PID 4908 wrote to memory of 5748 4908 net.exe 123 PID 2880 wrote to memory of 6060 2880 cmd.exe 124 PID 6060 wrote to memory of 4112 6060 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe 125 PID 4112 wrote to memory of 5872 4112 cmd.exe 127 PID 5872 wrote to memory of 4688 5872 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe 128 PID 4688 wrote to memory of 2688 4688 cmd.exe 130 PID 2688 wrote to memory of 4356 2688 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe 131 PID 4356 wrote to memory of 4476 4356 cmd.exe 133 PID 4476 wrote to memory of 3248 4476 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe 134 PID 3248 wrote to memory of 2860 3248 cmd.exe 136 PID 2860 wrote to memory of 4092 2860 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe 137 PID 4092 wrote to memory of 3760 4092 cmd.exe 139 PID 3760 wrote to memory of 3404 3760 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe 140 PID 3404 wrote to memory of 1480 3404 cmd.exe 142 PID 1480 wrote to memory of 876 1480 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe 143 PID 876 wrote to memory of 3040 876 cmd.exe 145 PID 3040 wrote to memory of 5924 3040 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe 146 PID 5924 wrote to memory of 6052 5924 cmd.exe 148 PID 6052 wrote to memory of 4716 6052 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe 149 PID 4716 wrote to memory of 3732 4716 cmd.exe 151 PID 3732 wrote to memory of 3528 3732 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe 152 PID 3528 wrote to memory of 5388 3528 cmd.exe 154 PID 5388 wrote to memory of 5432 5388 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe 155 PID 5432 wrote to memory of 5992 5432 cmd.exe 157 PID 5992 wrote to memory of 3464 5992 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe 158 PID 3464 wrote to memory of 3028 3464 cmd.exe 160 PID 3028 wrote to memory of 3764 3028 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe 161 PID 3764 wrote to memory of 1184 3764 cmd.exe 163 PID 1184 wrote to memory of 352 1184 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe 164 PID 352 wrote to memory of 5240 352 cmd.exe 166 PID 5240 wrote to memory of 4752 5240 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe 167 PID 4752 wrote to memory of 5188 4752 cmd.exe 169 PID 5188 wrote to memory of 4504 5188 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe 170 PID 4504 wrote to memory of 3540 4504 cmd.exe 172 PID 3540 wrote to memory of 4452 3540 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe 173 PID 4452 wrote to memory of 1992 4452 cmd.exe 175 PID 1992 wrote to memory of 4860 1992 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe 176 PID 4860 wrote to memory of 5444 4860 cmd.exe 178 PID 5444 wrote to memory of 4444 5444 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe 179 PID 4444 wrote to memory of 1308 4444 cmd.exe 181 PID 1308 wrote to memory of 3108 1308 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe 182 PID 3108 wrote to memory of 5040 3108 cmd.exe 184 PID 5040 wrote to memory of 3656 5040 413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe 185 PID 3656 wrote to memory of 4264 3656 cmd.exe 187
Processes
-
C:\Users\Admin\AppData\Local\Temp\413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe"C:\Users\Admin\AppData\Local\Temp\413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3204 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3AEC.bat2⤵
- Suspicious use of WriteProcessMemory
PID:3280 -
C:\Users\Admin\AppData\Local\Temp\413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe"C:\Users\Admin\AppData\Local\Temp\413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:260 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3E09.bat4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3616 -
C:\Users\Admin\AppData\Local\Temp\413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe"C:\Users\Admin\AppData\Local\Temp\413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1512 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a42BC.bat6⤵
- Suspicious use of WriteProcessMemory
PID:4408 -
C:\Users\Admin\AppData\Local\Temp\413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe"C:\Users\Admin\AppData\Local\Temp\413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe"7⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:5860 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a46B4.bat8⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe"C:\Users\Admin\AppData\Local\Temp\413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1348 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a49F0.bat10⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2200 -
C:\Users\Admin\AppData\Local\Temp\413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe"C:\Users\Admin\AppData\Local\Temp\413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe"11⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1324 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4D99.bat12⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5712 -
C:\Users\Admin\AppData\Local\Temp\413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe"C:\Users\Admin\AppData\Local\Temp\413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4852 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a527B.bat14⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3804 -
C:\Users\Admin\AppData\Local\Temp\413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe"C:\Users\Admin\AppData\Local\Temp\413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe"15⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:772 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5AA9.bat16⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe"C:\Users\Admin\AppData\Local\Temp\413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6060 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5DE5.bat18⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4112 -
C:\Users\Admin\AppData\Local\Temp\413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe"C:\Users\Admin\AppData\Local\Temp\413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5872 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6150.bat20⤵
- Suspicious use of WriteProcessMemory
PID:4688 -
C:\Users\Admin\AppData\Local\Temp\413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe"C:\Users\Admin\AppData\Local\Temp\413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a64DA.bat22⤵
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\Users\Admin\AppData\Local\Temp\413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe"C:\Users\Admin\AppData\Local\Temp\413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4476 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6807.bat24⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3248 -
C:\Users\Admin\AppData\Local\Temp\413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe"C:\Users\Admin\AppData\Local\Temp\413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe"25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6B72.bat26⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4092 -
C:\Users\Admin\AppData\Local\Temp\413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe"C:\Users\Admin\AppData\Local\Temp\413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3760 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6ECD.bat28⤵
- Suspicious use of WriteProcessMemory
PID:3404 -
C:\Users\Admin\AppData\Local\Temp\413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe"C:\Users\Admin\AppData\Local\Temp\413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1480 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a73AF.bat30⤵
- Suspicious use of WriteProcessMemory
PID:876 -
C:\Users\Admin\AppData\Local\Temp\413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe"C:\Users\Admin\AppData\Local\Temp\413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe"31⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7584.bat32⤵
- Suspicious use of WriteProcessMemory
PID:5924 -
C:\Users\Admin\AppData\Local\Temp\413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe"C:\Users\Admin\AppData\Local\Temp\413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6052 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a78B1.bat34⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4716 -
C:\Users\Admin\AppData\Local\Temp\413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe"C:\Users\Admin\AppData\Local\Temp\413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe"35⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3732 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7BFC.bat36⤵
- Suspicious use of WriteProcessMemory
PID:3528 -
C:\Users\Admin\AppData\Local\Temp\413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe"C:\Users\Admin\AppData\Local\Temp\413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe"37⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:5388 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7FF4.bat38⤵
- Suspicious use of WriteProcessMemory
PID:5432 -
C:\Users\Admin\AppData\Local\Temp\413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe"C:\Users\Admin\AppData\Local\Temp\413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe"39⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:5992 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8301.bat40⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3464 -
C:\Users\Admin\AppData\Local\Temp\413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe"C:\Users\Admin\AppData\Local\Temp\413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe"41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a83FB.bat42⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3764 -
C:\Users\Admin\AppData\Local\Temp\413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe"C:\Users\Admin\AppData\Local\Temp\413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1184 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8514.bat44⤵
- Suspicious use of WriteProcessMemory
PID:352 -
C:\Users\Admin\AppData\Local\Temp\413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe"C:\Users\Admin\AppData\Local\Temp\413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5240 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a861E.bat46⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4752 -
C:\Users\Admin\AppData\Local\Temp\413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe"C:\Users\Admin\AppData\Local\Temp\413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe"47⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5188 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8718.bat48⤵
- Suspicious use of WriteProcessMemory
PID:4504 -
C:\Users\Admin\AppData\Local\Temp\413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe"C:\Users\Admin\AppData\Local\Temp\413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe"49⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3540 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8822.bat50⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4452 -
C:\Users\Admin\AppData\Local\Temp\413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe"C:\Users\Admin\AppData\Local\Temp\413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a890C.bat52⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe"C:\Users\Admin\AppData\Local\Temp\413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5444 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8A45.bat54⤵
- Suspicious use of WriteProcessMemory
PID:4444 -
C:\Users\Admin\AppData\Local\Temp\413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe"C:\Users\Admin\AppData\Local\Temp\413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1308 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8B3F.bat56⤵
- Suspicious use of WriteProcessMemory
PID:3108 -
C:\Users\Admin\AppData\Local\Temp\413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe"C:\Users\Admin\AppData\Local\Temp\413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5040 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8C19.bat58⤵
- Suspicious use of WriteProcessMemory
PID:3656 -
C:\Users\Admin\AppData\Local\Temp\413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe"C:\Users\Admin\AppData\Local\Temp\413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe"59⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4264 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8D04.bat60⤵
- System Location Discovery: System Language Discovery
PID:3472 -
C:\Users\Admin\AppData\Local\Temp\413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe"C:\Users\Admin\AppData\Local\Temp\413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe"61⤵
- Executes dropped EXE
PID:6024 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8E1D.bat62⤵PID:4332
-
C:\Users\Admin\AppData\Local\Temp\413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe"C:\Users\Admin\AppData\Local\Temp\413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe"63⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5228 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8F27.bat64⤵
- Executes a command shell one-liner
PID:1132 -
C:\Users\Admin\AppData\Local\Temp\413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe"C:\Users\Admin\AppData\Local\Temp\413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe"65⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2704 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9040.bat66⤵PID:4500
-
C:\Users\Admin\AppData\Local\Temp\413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe"C:\Users\Admin\AppData\Local\Temp\413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe"67⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3796 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9149.bat68⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe"C:\Users\Admin\AppData\Local\Temp\413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe"69⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5532 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9263.bat70⤵
- Executes a command shell one-liner
PID:820 -
C:\Users\Admin\AppData\Local\Temp\413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe"C:\Users\Admin\AppData\Local\Temp\413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe"71⤵
- Executes dropped EXE
PID:3440 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a937C.bat72⤵
- System Location Discovery: System Language Discovery
PID:5888 -
C:\Users\Admin\AppData\Local\Temp\413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe"C:\Users\Admin\AppData\Local\Temp\413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe"73⤵
- Executes dropped EXE
PID:2904 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9466.bat74⤵PID:6104
-
C:\Users\Admin\AppData\Local\Temp\413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe"C:\Users\Admin\AppData\Local\Temp\413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe"75⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4224 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9580.bat76⤵PID:2532
-
C:\Users\Admin\AppData\Local\Temp\413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe"C:\Users\Admin\AppData\Local\Temp\413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe"77⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4156 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a964B.bat78⤵PID:5720
-
C:\Users\Admin\AppData\Local\Temp\413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe"C:\Users\Admin\AppData\Local\Temp\413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe"79⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4180 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9716.bat80⤵PID:4748
-
C:\Users\Admin\AppData\Local\Temp\413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe"C:\Users\Admin\AppData\Local\Temp\413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe"81⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3892 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9800.bat82⤵
- Executes a command shell one-liner
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe"C:\Users\Admin\AppData\Local\Temp\413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe"83⤵
- Executes dropped EXE
PID:616 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a98CB.bat84⤵PID:2684
-
C:\Users\Admin\AppData\Local\Temp\413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe"C:\Users\Admin\AppData\Local\Temp\413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe"85⤵
- Executes dropped EXE
PID:5772 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a99C5.bat86⤵PID:4124
-
C:\Users\Admin\AppData\Local\Temp\413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe"C:\Users\Admin\AppData\Local\Temp\413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe"87⤵
- Executes dropped EXE
PID:4284 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9AA0.bat88⤵PID:924
-
C:\Users\Admin\AppData\Local\Temp\413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe"C:\Users\Admin\AppData\Local\Temp\413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe"89⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4128 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9B9A.bat90⤵PID:5248
-
C:\Users\Admin\AppData\Local\Temp\413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe"C:\Users\Admin\AppData\Local\Temp\413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe"91⤵
- Executes dropped EXE
PID:1416 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9C84.bat92⤵
- Executes a command shell one-liner
PID:1108 -
C:\Users\Admin\AppData\Local\Temp\413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe"C:\Users\Admin\AppData\Local\Temp\413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe"93⤵
- Executes dropped EXE
PID:4708 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9D8E.bat94⤵PID:2236
-
C:\Users\Admin\AppData\Local\Temp\413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe"C:\Users\Admin\AppData\Local\Temp\413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe"95⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2728 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9E69.bat96⤵PID:3416
-
C:\Users\Admin\AppData\Local\Temp\413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe"C:\Users\Admin\AppData\Local\Temp\413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe"97⤵
- Executes dropped EXE
PID:472 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9F34.bat98⤵PID:828
-
C:\Users\Admin\AppData\Local\Temp\413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe"C:\Users\Admin\AppData\Local\Temp\413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe"99⤵
- Executes dropped EXE
PID:3224 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA02E.bat100⤵PID:2488
-
C:\Users\Admin\AppData\Local\Temp\413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe"C:\Users\Admin\AppData\Local\Temp\413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe"101⤵
- Executes dropped EXE
PID:5880 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA109.bat102⤵PID:4044
-
C:\Users\Admin\AppData\Local\Temp\413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe"C:\Users\Admin\AppData\Local\Temp\413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe"103⤵
- Executes dropped EXE
PID:4836 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA1D4.bat104⤵
- Executes a command shell one-liner
PID:4788 -
C:\Users\Admin\AppData\Local\Temp\413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe"C:\Users\Admin\AppData\Local\Temp\413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe"105⤵
- Executes dropped EXE
PID:3252 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA2BE.bat106⤵PID:4304
-
C:\Users\Admin\AppData\Local\Temp\413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe"C:\Users\Admin\AppData\Local\Temp\413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe"107⤵
- Executes dropped EXE
PID:3696 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA3B8.bat108⤵PID:2328
-
C:\Users\Admin\AppData\Local\Temp\413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe"C:\Users\Admin\AppData\Local\Temp\413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe"109⤵
- Executes dropped EXE
PID:3288 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA4E1.bat110⤵
- Executes a command shell one-liner
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe"C:\Users\Admin\AppData\Local\Temp\413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe"111⤵
- Executes dropped EXE
PID:5476 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA5BC.bat112⤵PID:2060
-
C:\Users\Admin\AppData\Local\Temp\413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe"C:\Users\Admin\AppData\Local\Temp\413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe"113⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2316 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA6B6.bat114⤵PID:3420
-
C:\Users\Admin\AppData\Local\Temp\413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe"C:\Users\Admin\AppData\Local\Temp\413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe"115⤵
- Executes dropped EXE
PID:1272 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA791.bat116⤵PID:3060
-
C:\Users\Admin\AppData\Local\Temp\413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe"C:\Users\Admin\AppData\Local\Temp\413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe"117⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5996 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA84C.bat118⤵PID:2996
-
C:\Users\Admin\AppData\Local\Temp\413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe"C:\Users\Admin\AppData\Local\Temp\413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe"119⤵
- Executes dropped EXE
PID:3044 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA946.bat120⤵
- Executes a command shell one-liner
PID:1148 -
C:\Users\Admin\AppData\Local\Temp\413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe"C:\Users\Admin\AppData\Local\Temp\413abf83958b2f8fe1f6dc4cc4c57f9eb7151037873b9d597bc89ae949a81042.exe"121⤵
- Executes dropped EXE
PID:4196
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-