Analysis
- max time kernel
150s - max time network
140s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
28/09/2026, 23:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe
- Size 7.3MB
- Sample260928-3m3ftaxt9p
- SHA256 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e
- MD5 c05052576c68382b9f929462972f34d1
- SHA1 2c95363cf40cb49e646357e63aea7eae39138fd3
- SHA512 20397679ef2b6350bbf037e261ca5cdf24f57951659eca7501191fc7af26707d3dc34bde5f1ee9e5c82741f6edbe005868db0c7b95f19cafdd07f8a544837489
- SSDEEP 98304:iLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLl:CjJb
- TLSH T1D276E18193D9A479E5C3163450B38FCBE7697461E7218B4F906402FDEDC02E5AE2AFB4
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 2956 Logo1_.exe 3100 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe 1948 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe 2008 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe 5520 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe 1920 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe 452 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe 4864 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe 4996 Logo1_.exe 5912 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe 5216 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe 1848 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe 3384 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe 1988 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe 1940 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe 2080 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe 2020 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe 6096 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe 1548 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe 3136 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe 296 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe 924 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe 2220 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe 5480 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe 4464 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe 4420 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe 5476 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe 5988 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe 2032 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe 2832 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe 3664 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe 3076 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe 6084 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe 5168 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe 3780 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe 4784 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe 5340 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe 2952 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe 1844 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe 2896 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe 4148 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe 5408 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe 5944 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe 4460 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe 2700 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe 5344 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe 4436 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe 2356 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe 5828 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe 3176 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe 4848 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe 1868 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe 4052 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe 6112 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe 2840 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe 2388 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe 3772 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe 5448 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe 2276 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe 3636 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe 684 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe 4960 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe 1708 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe 5196 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe - Enumerates connected drives 3 TTPs 44 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\D: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe \??\F:\ Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\D: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe \??\F:\ Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\ja\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\LEVEL\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\dotnet\host\fxr\8.0.15\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\include\win32\bridge\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\Office16\FORMS\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OutlookAutoDiscover\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\ECHO\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jre-1.8\bin\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jre-1.8\legal\javafx\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\MSBuild\_desktop.ini Logo1_.exe File created C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\dtplugin\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\ms\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\ru\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\WATERMAR\_desktop.ini Logo1_.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\IwaKeyDistribution\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\sr-Cyrl-RS\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\EVRGREEN\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\LISTS\1033\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CAPSULES\_desktop.ini Logo1_.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\sr-Cyrl-BA\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\unlimited\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\ext\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\hu\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\dotnet\host\fxr\6.0.27\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\fr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\_desktop.ini Logo1_.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\PrivacySandboxAttestationsPreloaded\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\bg\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\VBA\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\es\_desktop.ini Logo1_.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\tr\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Resources\1033\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\gl\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\DESIGNER\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\fonts\_desktop.ini Logo1_.exe File created C:\Program Files\dotnet\swidtag\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CASCADE\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SATIN\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\de\_desktop.ini Logo1_.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\zh-Hans\_desktop.ini Logo1_.exe File created C:\Program Files\Internet Explorer\it-IT\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\Office16\OutlookAutoDiscover\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\_desktop.ini Logo1_.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\Logo1_.exe 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe File created C:\Windows\Logo1_.exe 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe File created C:\Windows\Logo1_.exe 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe File created C:\Windows\Logo1_.exe 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe File created C:\Windows\Logo1_.exe 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe File created C:\Windows\Logo1_.exe 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe File created C:\Windows\Logo1_.exe 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe File created C:\Windows\Logo1_.exe 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe File created C:\Windows\Logo1_.exe 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe File created C:\Windows\Logo1_.exe 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe File created C:\Windows\Logo1_.exe 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe File created C:\Windows\Logo1_.exe 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe File created C:\Windows\Logo1_.exe 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe File created C:\Windows\Logo1_.exe 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe File created C:\Windows\Logo1_.exe 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe File created C:\Windows\Logo1_.exe 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe File created C:\Windows\Logo1_.exe 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe File created C:\Windows\Logo1_.exe 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe File created C:\Windows\Logo1_.exe 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe File created C:\Windows\Logo1_.exe 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe File created C:\Windows\Logo1_.exe 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe File created C:\Windows\Logo1_.exe 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe File created C:\Windows\Logo1_.exe 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe File created C:\Windows\Logo1_.exe 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe File created C:\Windows\Logo1_.exe 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe File created C:\Windows\Logo1_.exe 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe File created C:\Windows\Logo1_.exe 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe File created C:\Windows\Logo1_.exe 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe File created C:\Windows\Logo1_.exe 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe File created C:\Windows\Logo1_.exe 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe File created C:\Windows\Logo1_.exe 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe File created C:\Windows\Logo1_.exe 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe File created C:\Windows\Logo1_.exe 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe File created C:\Windows\Logo1_.exe 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe File created C:\Windows\Logo1_.exe 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe File opened for modification C:\Windows\rundl132.exe 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe File created C:\Windows\Logo1_.exe 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe File created C:\Windows\Logo1_.exe 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe File created C:\Windows\Logo1_.exe 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe File created C:\Windows\Logo1_.exe 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe File created C:\Windows\Logo1_.exe 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe File created C:\Windows\Logo1_.exe 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe File created C:\Windows\Logo1_.exe 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe File created C:\Windows\Logo1_.exe 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe File created C:\Windows\Logo1_.exe 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe File created C:\Windows\Dll.dll Logo1_.exe File created C:\Windows\Logo1_.exe 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe File created C:\Windows\Logo1_.exe 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe File created C:\Windows\Logo1_.exe 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe File created C:\Windows\Logo1_.exe 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe File created C:\Windows\Logo1_.exe 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe File created C:\Windows\Logo1_.exe 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe File created C:\Windows\Logo1_.exe 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe File created C:\Windows\Logo1_.exe 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe File created C:\Windows\Logo1_.exe 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe File created C:\Windows\Logo1_.exe 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe File created C:\Windows\Logo1_.exe 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe File created C:\Windows\Logo1_.exe 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe File created C:\Windows\Logo1_.exe 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe File created C:\Windows\Logo1_.exe 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe File created C:\Windows\Logo1_.exe 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe File created C:\Windows\Logo1_.exe 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe File created C:\Windows\Logo1_.exe 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe File created C:\Windows\Logo1_.exe 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe - Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 3196 cmd.exe 4360 cmd.exe 4264 cmd.exe 5964 cmd.exe 5600 cmd.exe 3064 cmd.exe 1964 cmd.exe 6140 cmd.exe 1752 cmd.exe 3288 cmd.exe 5660 cmd.exe 5328 cmd.exe 52 cmd.exe 4596 cmd.exe 4660 cmd.exe 4572 cmd.exe 4940 cmd.exe 4128 cmd.exe 1120 cmd.exe 5368 cmd.exe 3688 cmd.exe 3556 cmd.exe 3180 cmd.exe 4216 cmd.exe 5472 cmd.exe 1376 cmd.exe 1356 cmd.exe 4936 cmd.exe 1084 cmd.exe 4652 cmd.exe 3796 cmd.exe 3452 cmd.exe 124 cmd.exe 1112 cmd.exe 5624 cmd.exe 5376 cmd.exe 460 cmd.exe 704 cmd.exe 5552 cmd.exe 1760 cmd.exe 2776 cmd.exe 5384 cmd.exe 4440 cmd.exe 5288 cmd.exe 5056 cmd.exe 3788 cmd.exe 5048 cmd.exe 1764 cmd.exe 3592 cmd.exe 1292 cmd.exe 1480 cmd.exe 5060 cmd.exe 236 cmd.exe 3920 cmd.exe 4792 cmd.exe 2536 cmd.exe 2596 cmd.exe 5428 cmd.exe 4364 cmd.exe 5460 cmd.exe 3948 cmd.exe 3692 cmd.exe 6020 cmd.exe 1156 cmd.exe - Program crash 1 IoCs
pid pid_target Process procid_target 5588 2956 WerFault.exe 90 - Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname Logo1_.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain Logo1_.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname Logo1_.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain Logo1_.exe - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Logo1_.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Runs net.exe
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4956 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe 4956 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe 4956 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe 4956 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe 4956 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe 4956 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe 4956 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe 4956 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe 4956 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe 4956 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe 4956 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe 4956 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe 4956 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe 4956 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe 4956 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe 4956 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe 4956 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe 4956 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe 2956 Logo1_.exe 2956 Logo1_.exe 2956 Logo1_.exe 2956 Logo1_.exe 2956 Logo1_.exe 2956 Logo1_.exe 2956 Logo1_.exe 2956 Logo1_.exe 2956 Logo1_.exe 2956 Logo1_.exe 2956 Logo1_.exe 2956 Logo1_.exe 2956 Logo1_.exe 2956 Logo1_.exe 2956 Logo1_.exe 2956 Logo1_.exe 2956 Logo1_.exe 2956 Logo1_.exe 2956 Logo1_.exe 2956 Logo1_.exe 2956 Logo1_.exe 2956 Logo1_.exe 2956 Logo1_.exe 2956 Logo1_.exe 2956 Logo1_.exe 2956 Logo1_.exe 2956 Logo1_.exe 2956 Logo1_.exe 2956 Logo1_.exe 2956 Logo1_.exe 2956 Logo1_.exe 2956 Logo1_.exe 2956 Logo1_.exe 2956 Logo1_.exe 2956 Logo1_.exe 2956 Logo1_.exe 2956 Logo1_.exe 2956 Logo1_.exe 2956 Logo1_.exe 2956 Logo1_.exe 2956 Logo1_.exe 2956 Logo1_.exe 2956 Logo1_.exe 2956 Logo1_.exe 4864 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe 4864 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4956 wrote to memory of 5236 4956 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe 89 PID 4956 wrote to memory of 2956 4956 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe 90 PID 2956 wrote to memory of 4260 2956 Logo1_.exe 91 PID 4260 wrote to memory of 1132 4260 net.exe 93 PID 5236 wrote to memory of 3100 5236 cmd.exe 95 PID 3100 wrote to memory of 3796 3100 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe 96 PID 3796 wrote to memory of 1948 3796 cmd.exe 98 PID 1948 wrote to memory of 3464 1948 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe 99 PID 3464 wrote to memory of 2008 3464 cmd.exe 101 PID 2008 wrote to memory of 5752 2008 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe 102 PID 5752 wrote to memory of 5520 5752 cmd.exe 104 PID 5520 wrote to memory of 744 5520 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe 105 PID 744 wrote to memory of 1920 744 cmd.exe 107 PID 1920 wrote to memory of 956 1920 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe 108 PID 956 wrote to memory of 452 956 cmd.exe 111 PID 452 wrote to memory of 2236 452 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe 113 PID 2236 wrote to memory of 4864 2236 cmd.exe 116 PID 4864 wrote to memory of 2968 4864 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe 117 PID 4864 wrote to memory of 4996 4864 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe 118 PID 4996 wrote to memory of 3680 4996 Logo1_.exe 119 PID 3680 wrote to memory of 1128 3680 net.exe 122 PID 2968 wrote to memory of 5912 2968 cmd.exe 123 PID 5912 wrote to memory of 4264 5912 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe 124 PID 4264 wrote to memory of 5216 4264 cmd.exe 126 PID 5216 wrote to memory of 3132 5216 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe 127 PID 3132 wrote to memory of 1848 3132 cmd.exe 129 PID 1848 wrote to memory of 3312 1848 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe 130 PID 3312 wrote to memory of 3384 3312 cmd.exe 132 PID 3384 wrote to memory of 2288 3384 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe 133 PID 2288 wrote to memory of 1988 2288 cmd.exe 135 PID 1988 wrote to memory of 1108 1988 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe 136 PID 1108 wrote to memory of 1940 1108 cmd.exe 138 PID 1940 wrote to memory of 5964 1940 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe 139 PID 5964 wrote to memory of 2080 5964 cmd.exe 141 PID 2080 wrote to memory of 3936 2080 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe 142 PID 3936 wrote to memory of 2020 3936 cmd.exe 144 PID 2020 wrote to memory of 6016 2020 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe 145 PID 6016 wrote to memory of 6096 6016 cmd.exe 147 PID 6096 wrote to memory of 3016 6096 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe 148 PID 3016 wrote to memory of 1548 3016 cmd.exe 150 PID 1548 wrote to memory of 5536 1548 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe 151 PID 5536 wrote to memory of 3136 5536 cmd.exe 153 PID 3136 wrote to memory of 5280 3136 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe 154 PID 5280 wrote to memory of 296 5280 cmd.exe 156 PID 296 wrote to memory of 5268 296 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe 157 PID 5268 wrote to memory of 924 5268 cmd.exe 159 PID 924 wrote to memory of 3436 924 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe 160 PID 3436 wrote to memory of 2220 3436 cmd.exe 162 PID 2220 wrote to memory of 5552 2220 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe 163 PID 5552 wrote to memory of 5480 5552 cmd.exe 165 PID 5480 wrote to memory of 1896 5480 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe 166 PID 1896 wrote to memory of 4464 1896 cmd.exe 168 PID 4464 wrote to memory of 3920 4464 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe 169 PID 3920 wrote to memory of 4420 3920 cmd.exe 171 PID 4420 wrote to memory of 2544 4420 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe 172 PID 2544 wrote to memory of 5476 2544 cmd.exe 174 PID 5476 wrote to memory of 4528 5476 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe 175 PID 4528 wrote to memory of 5988 4528 cmd.exe 177 PID 5988 wrote to memory of 5780 5988 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe 178 PID 5780 wrote to memory of 2032 5780 cmd.exe 180 PID 2032 wrote to memory of 1120 2032 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe 181 PID 1120 wrote to memory of 2832 1120 cmd.exe 183 PID 2832 wrote to memory of 2320 2832 140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe 184 PID 2320 wrote to memory of 3664 2320 cmd.exe 186
Processes
-
C:\Users\Admin\AppData\Local\Temp\140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe"C:\Users\Admin\AppData\Local\Temp\140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a74E8.bat2⤵
- Suspicious use of WriteProcessMemory
PID:5236 -
C:\Users\Admin\AppData\Local\Temp\140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe"C:\Users\Admin\AppData\Local\Temp\140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3100 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7891.bat4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3796 -
C:\Users\Admin\AppData\Local\Temp\140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe"C:\Users\Admin\AppData\Local\Temp\140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7CE7.bat6⤵
- Suspicious use of WriteProcessMemory
PID:3464 -
C:\Users\Admin\AppData\Local\Temp\140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe"C:\Users\Admin\AppData\Local\Temp\140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe"7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a811D.bat8⤵
- Suspicious use of WriteProcessMemory
PID:5752 -
C:\Users\Admin\AppData\Local\Temp\140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe"C:\Users\Admin\AppData\Local\Temp\140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe"9⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:5520 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a84C6.bat10⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:744 -
C:\Users\Admin\AppData\Local\Temp\140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe"C:\Users\Admin\AppData\Local\Temp\140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a88CE.bat12⤵
- Suspicious use of WriteProcessMemory
PID:956 -
C:\Users\Admin\AppData\Local\Temp\140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe"C:\Users\Admin\AppData\Local\Temp\140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:452 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a91B7.bat14⤵
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe"C:\Users\Admin\AppData\Local\Temp\140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe"15⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9699.bat16⤵
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe"C:\Users\Admin\AppData\Local\Temp\140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe"17⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:5912 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9958.bat18⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4264 -
C:\Users\Admin\AppData\Local\Temp\140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe"C:\Users\Admin\AppData\Local\Temp\140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5216 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9D50.bat20⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3132 -
C:\Users\Admin\AppData\Local\Temp\140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe"C:\Users\Admin\AppData\Local\Temp\140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1848 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA260.bat22⤵
- Suspicious use of WriteProcessMemory
PID:3312 -
C:\Users\Admin\AppData\Local\Temp\140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe"C:\Users\Admin\AppData\Local\Temp\140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe"23⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3384 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA668.bat24⤵
- Suspicious use of WriteProcessMemory
PID:2288 -
C:\Users\Admin\AppData\Local\Temp\140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe"C:\Users\Admin\AppData\Local\Temp\140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAA02.bat26⤵
- Suspicious use of WriteProcessMemory
PID:1108 -
C:\Users\Admin\AppData\Local\Temp\140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe"C:\Users\Admin\AppData\Local\Temp\140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAE09.bat28⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5964 -
C:\Users\Admin\AppData\Local\Temp\140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe"C:\Users\Admin\AppData\Local\Temp\140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB1B2.bat30⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3936 -
C:\Users\Admin\AppData\Local\Temp\140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe"C:\Users\Admin\AppData\Local\Temp\140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB608.bat32⤵
- Suspicious use of WriteProcessMemory
PID:6016 -
C:\Users\Admin\AppData\Local\Temp\140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe"C:\Users\Admin\AppData\Local\Temp\140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6096 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB8E6.bat34⤵
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe"C:\Users\Admin\AppData\Local\Temp\140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1548 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBC70.bat36⤵
- Suspicious use of WriteProcessMemory
PID:5536 -
C:\Users\Admin\AppData\Local\Temp\140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe"C:\Users\Admin\AppData\Local\Temp\140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe"37⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3136 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBFBC.bat38⤵
- Suspicious use of WriteProcessMemory
PID:5280 -
C:\Users\Admin\AppData\Local\Temp\140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe"C:\Users\Admin\AppData\Local\Temp\140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:296 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC356.bat40⤵
- Suspicious use of WriteProcessMemory
PID:5268 -
C:\Users\Admin\AppData\Local\Temp\140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe"C:\Users\Admin\AppData\Local\Temp\140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe"41⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:924 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC450.bat42⤵
- Suspicious use of WriteProcessMemory
PID:3436 -
C:\Users\Admin\AppData\Local\Temp\140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe"C:\Users\Admin\AppData\Local\Temp\140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC55A.bat44⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5552 -
C:\Users\Admin\AppData\Local\Temp\140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe"C:\Users\Admin\AppData\Local\Temp\140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe"45⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:5480 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC625.bat46⤵
- Suspicious use of WriteProcessMemory
PID:1896 -
C:\Users\Admin\AppData\Local\Temp\140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe"C:\Users\Admin\AppData\Local\Temp\140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4464 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC73E.bat48⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3920 -
C:\Users\Admin\AppData\Local\Temp\140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe"C:\Users\Admin\AppData\Local\Temp\140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4420 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC838.bat50⤵
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe"C:\Users\Admin\AppData\Local\Temp\140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5476 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC922.bat52⤵
- Suspicious use of WriteProcessMemory
PID:4528 -
C:\Users\Admin\AppData\Local\Temp\140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe"C:\Users\Admin\AppData\Local\Temp\140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe"53⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:5988 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCA0D.bat54⤵
- Suspicious use of WriteProcessMemory
PID:5780 -
C:\Users\Admin\AppData\Local\Temp\140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe"C:\Users\Admin\AppData\Local\Temp\140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCB16.bat56⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1120 -
C:\Users\Admin\AppData\Local\Temp\140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe"C:\Users\Admin\AppData\Local\Temp\140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCC01.bat58⤵
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\Users\Admin\AppData\Local\Temp\140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe"C:\Users\Admin\AppData\Local\Temp\140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe"59⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3664 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCCEB.bat60⤵PID:3776
-
C:\Users\Admin\AppData\Local\Temp\140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe"C:\Users\Admin\AppData\Local\Temp\140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe"61⤵
- Executes dropped EXE
PID:3076 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCE04.bat62⤵
- Executes a command shell one-liner
PID:5660 -
C:\Users\Admin\AppData\Local\Temp\140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe"C:\Users\Admin\AppData\Local\Temp\140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe"63⤵
- Executes dropped EXE
PID:6084 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCF0E.bat64⤵PID:2572
-
C:\Users\Admin\AppData\Local\Temp\140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe"C:\Users\Admin\AppData\Local\Temp\140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe"65⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5168 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCFD9.bat66⤵
- Executes a command shell one-liner
PID:1376 -
C:\Users\Admin\AppData\Local\Temp\140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe"C:\Users\Admin\AppData\Local\Temp\140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe"67⤵
- Executes dropped EXE
PID:3780 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD0D3.bat68⤵
- System Location Discovery: System Language Discovery
PID:3108 -
C:\Users\Admin\AppData\Local\Temp\140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe"C:\Users\Admin\AppData\Local\Temp\140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe"69⤵
- Executes dropped EXE
PID:4784 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD1BD.bat70⤵PID:1300
-
C:\Users\Admin\AppData\Local\Temp\140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe"C:\Users\Admin\AppData\Local\Temp\140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe"71⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5340 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD2C7.bat72⤵PID:612
-
C:\Users\Admin\AppData\Local\Temp\140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe"C:\Users\Admin\AppData\Local\Temp\140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe"73⤵
- Executes dropped EXE
PID:2952 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD3C1.bat74⤵
- System Location Discovery: System Language Discovery
PID:1372 -
C:\Users\Admin\AppData\Local\Temp\140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe"C:\Users\Admin\AppData\Local\Temp\140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe"75⤵
- Executes dropped EXE
PID:1844 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD49C.bat76⤵
- Executes a command shell one-liner
PID:5328 -
C:\Users\Admin\AppData\Local\Temp\140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe"C:\Users\Admin\AppData\Local\Temp\140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe"77⤵
- Executes dropped EXE
PID:2896 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD586.bat78⤵PID:688
-
C:\Users\Admin\AppData\Local\Temp\140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe"C:\Users\Admin\AppData\Local\Temp\140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe"79⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4148 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD690.bat80⤵
- Executes a command shell one-liner
PID:3452 -
C:\Users\Admin\AppData\Local\Temp\140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe"C:\Users\Admin\AppData\Local\Temp\140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe"81⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5408 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD77A.bat82⤵PID:1456
-
C:\Users\Admin\AppData\Local\Temp\140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe"C:\Users\Admin\AppData\Local\Temp\140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe"83⤵
- Executes dropped EXE
PID:5944 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD874.bat84⤵
- System Location Discovery: System Language Discovery
PID:952 -
C:\Users\Admin\AppData\Local\Temp\140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe"C:\Users\Admin\AppData\Local\Temp\140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe"85⤵
- Executes dropped EXE
PID:4460 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD96E.bat86⤵PID:1652
-
C:\Users\Admin\AppData\Local\Temp\140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe"C:\Users\Admin\AppData\Local\Temp\140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe"87⤵
- Executes dropped EXE
PID:2700 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDA59.bat88⤵
- Executes a command shell one-liner
PID:4792 -
C:\Users\Admin\AppData\Local\Temp\140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe"C:\Users\Admin\AppData\Local\Temp\140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe"89⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5344 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDB24.bat90⤵PID:1796
-
C:\Users\Admin\AppData\Local\Temp\140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe"C:\Users\Admin\AppData\Local\Temp\140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe"91⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4436 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDC0E.bat92⤵
- Executes a command shell one-liner
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe"C:\Users\Admin\AppData\Local\Temp\140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe"93⤵
- Executes dropped EXE
PID:2356 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDCE9.bat94⤵
- Executes a command shell one-liner
PID:52 -
C:\Users\Admin\AppData\Local\Temp\140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe"C:\Users\Admin\AppData\Local\Temp\140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe"95⤵
- Executes dropped EXE
PID:5828 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDDB4.bat96⤵
- System Location Discovery: System Language Discovery
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe"C:\Users\Admin\AppData\Local\Temp\140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe"97⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3176 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDE9E.bat98⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe"C:\Users\Admin\AppData\Local\Temp\140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe"99⤵
- Executes dropped EXE
PID:4848 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDF69.bat100⤵PID:1544
-
C:\Users\Admin\AppData\Local\Temp\140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe"C:\Users\Admin\AppData\Local\Temp\140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe"101⤵
- Executes dropped EXE
PID:1868 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE054.bat102⤵PID:5920
-
C:\Users\Admin\AppData\Local\Temp\140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe"C:\Users\Admin\AppData\Local\Temp\140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe"103⤵
- Executes dropped EXE
PID:4052 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE11F.bat104⤵PID:5976
-
C:\Users\Admin\AppData\Local\Temp\140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe"C:\Users\Admin\AppData\Local\Temp\140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe"105⤵
- Executes dropped EXE
PID:6112 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE1EA.bat106⤵
- Executes a command shell one-liner
PID:5600 -
C:\Users\Admin\AppData\Local\Temp\140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe"C:\Users\Admin\AppData\Local\Temp\140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe"107⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2840 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE2B5.bat108⤵PID:4580
-
C:\Users\Admin\AppData\Local\Temp\140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe"C:\Users\Admin\AppData\Local\Temp\140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe"109⤵
- Executes dropped EXE
PID:2388 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE390.bat110⤵PID:2948
-
C:\Users\Admin\AppData\Local\Temp\140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe"C:\Users\Admin\AppData\Local\Temp\140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe"111⤵
- Executes dropped EXE
PID:3772 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE45B.bat112⤵
- System Location Discovery: System Language Discovery
PID:3652 -
C:\Users\Admin\AppData\Local\Temp\140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe"C:\Users\Admin\AppData\Local\Temp\140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe"113⤵
- Executes dropped EXE
PID:5448 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE545.bat114⤵
- Executes a command shell one-liner
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe"C:\Users\Admin\AppData\Local\Temp\140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe"115⤵
- Executes dropped EXE
PID:2276 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE64F.bat116⤵
- Executes a command shell one-liner
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe"C:\Users\Admin\AppData\Local\Temp\140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe"117⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3636 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE739.bat118⤵
- Executes a command shell one-liner
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe"C:\Users\Admin\AppData\Local\Temp\140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe"119⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:684 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE833.bat120⤵PID:4156
-
C:\Users\Admin\AppData\Local\Temp\140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe"C:\Users\Admin\AppData\Local\Temp\140f462eec893f39bb034548cfe1ad70cb2ee0110e65447a9cf118ab4c0ab10e.exe"121⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4960
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-