Analysis
- max time kernel
149s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
28/09/2026, 13:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
12 signatures
150 seconds
General
- Target 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe
- Size 8.1MB
- Sample260928-q44c8aba62
- SHA256 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5
- MD5 26b52ff7f9521937166011a0b3a420a7
- SHA1 5055f2c1988bacd85c9ffb833be1f88bb81dba4f
- SHA512 97b0daa0a7f42d47318c0bec1d050401253a894813ebdfa190487f61095d86b158fa98a74e34d2dd8e98b989185ca3a99f6c344a42510e8d666bd44203764306
- SSDEEP 98304:iLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLu:CjJw
- TLSH T1D786E18193D9A479E5C3163450B38FCBE76974A1E7218B4F906402FDEDC02E5AE1AFB4
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 1852 Logo1_.exe 5900 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe 1536 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe 960 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe 4592 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe 5736 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe 5308 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe 540 Logo1_.exe 4428 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe 5936 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe 3424 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe 4360 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe 6112 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe 5940 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe 1400 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe 1836 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe 5876 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe 1884 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe 2060 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe 2888 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe 1108 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe 760 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe 2492 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe 2812 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe 2428 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe 4316 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe 4876 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe 2536 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe 3544 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe 4152 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe 5528 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe 4828 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe 1528 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe 5980 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe 1980 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe 3060 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe 6060 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe 3172 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe 5636 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe 3872 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe 5920 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe 4184 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe 3088 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe 832 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe 6092 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe 3760 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe 2440 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe 5524 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe 5420 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe 3444 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe 2116 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe 5868 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe 2772 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe 1284 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe 2024 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe 864 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe 2928 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe 3428 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe 1256 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe 4936 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe 984 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe 2652 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe 1232 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe 3832 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe - Enumerates connected drives 3 TTPs 44 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe \??\F:\ Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\D: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\D: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe \??\F:\ Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ja\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk-1.8\include\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1036\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000009\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\et\_desktop.ini Logo1_.exe File created C:\Program Files\_desktop.ini Logo1_.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\pt-BR\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000008\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Internet Explorer\images\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Configuration\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\7-Zip\Lang\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\zh-Hant\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\dtplugin\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\images\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jre-1.8\lib\jfr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\Bibliography\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\bg\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\el\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\_desktop.ini Logo1_.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ja\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\da\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\dotnet\host\fxr\8.0.15\_desktop.ini Logo1_.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Internet Explorer\ja-JP\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\applet\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\Office16\CONVERT\1033\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\dotnet\_desktop.ini Logo1_.exe File created C:\Program Files\Internet Explorer\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\legal\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jre-1.8\lib\amd64\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\ext\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jre-1.8\lib\management\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\Client\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\pl\_desktop.ini Logo1_.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\WidevineCdm\_platform_specific\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Bibliography\Sort\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\ar\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\en-us\_desktop.ini Logo1_.exe File created C:\Program Files\dotnet\host\fxr\7.0.16\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\lib\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jre-1.8\bin\dtplugin\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Resources\1033\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\Office16\FPA_f7\_desktop.ini Logo1_.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\_desktop.ini Logo1_.exe File created C:\Program Files\Internet Explorer\SIGNUP\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\_desktop.ini Logo1_.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\it\_desktop.ini Logo1_.exe File created C:\Program Files\Internet Explorer\it-IT\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\ext\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\dtplugin\_desktop.ini Logo1_.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\Logo1_.exe 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe File created C:\Windows\Logo1_.exe 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe File created C:\Windows\Logo1_.exe 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe File created C:\Windows\Logo1_.exe 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe File created C:\Windows\Logo1_.exe 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe File created C:\Windows\Logo1_.exe 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe File created C:\Windows\Logo1_.exe 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe File created C:\Windows\Logo1_.exe 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe File created C:\Windows\Logo1_.exe 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe File created C:\Windows\Logo1_.exe 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe File created C:\Windows\Logo1_.exe 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe File created C:\Windows\Logo1_.exe 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe File created C:\Windows\Logo1_.exe 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe File created C:\Windows\Logo1_.exe 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe File created C:\Windows\Logo1_.exe 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe File created C:\Windows\Logo1_.exe 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe File created C:\Windows\Logo1_.exe 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe File created C:\Windows\Logo1_.exe 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe File created C:\Windows\Logo1_.exe 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe File created C:\Windows\Logo1_.exe 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe File created C:\Windows\Logo1_.exe 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe File created C:\Windows\Logo1_.exe 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe File created C:\Windows\Logo1_.exe 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe File created C:\Windows\Logo1_.exe 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe File created C:\Windows\Logo1_.exe 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe File created C:\Windows\Logo1_.exe 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe File created C:\Windows\Logo1_.exe 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe File created C:\Windows\Logo1_.exe 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe File created C:\Windows\Logo1_.exe 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe File created C:\Windows\Logo1_.exe 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe File created C:\Windows\Logo1_.exe 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe File created C:\Windows\Logo1_.exe 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe File created C:\Windows\Logo1_.exe 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe File created C:\Windows\Logo1_.exe 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe File created C:\Windows\Logo1_.exe 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe File created C:\Windows\Logo1_.exe 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe File created C:\Windows\Logo1_.exe 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe File opened for modification C:\Windows\rundl132.exe 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe File created C:\Windows\Logo1_.exe 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe File created C:\Windows\Logo1_.exe 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe File created C:\Windows\Logo1_.exe 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe File created C:\Windows\Logo1_.exe 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe File created C:\Windows\Logo1_.exe 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe File created C:\Windows\Logo1_.exe 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe File created C:\Windows\Logo1_.exe 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe File created C:\Windows\Logo1_.exe 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe File created C:\Windows\Logo1_.exe 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe File created C:\Windows\Logo1_.exe 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe File created C:\Windows\Logo1_.exe 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe File created C:\Windows\Logo1_.exe 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe File created C:\Windows\Logo1_.exe 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe File created C:\Windows\Logo1_.exe 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe File created C:\Windows\Logo1_.exe 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe File created C:\Windows\Logo1_.exe 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe File created C:\Windows\Logo1_.exe 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe File created C:\Windows\Logo1_.exe 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe File created C:\Windows\Logo1_.exe 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe File created C:\Windows\Logo1_.exe 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe File created C:\Windows\Logo1_.exe 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe File created C:\Windows\Logo1_.exe 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe File created C:\Windows\Logo1_.exe 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe File created C:\Windows\Logo1_.exe 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe File created C:\Windows\Logo1_.exe 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe File created C:\Windows\Logo1_.exe 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe - Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 1768 cmd.exe 4496 cmd.exe 3120 cmd.exe 1540 cmd.exe 460 cmd.exe 1920 cmd.exe 5032 cmd.exe 2216 cmd.exe 2920 cmd.exe 2436 cmd.exe 2804 cmd.exe 4988 cmd.exe 4480 cmd.exe 2924 cmd.exe 1984 cmd.exe 1188 cmd.exe 676 cmd.exe 1204 cmd.exe 4540 cmd.exe 4312 cmd.exe 2796 cmd.exe 3152 cmd.exe 1412 cmd.exe 5928 cmd.exe 2816 cmd.exe 4332 cmd.exe 3968 cmd.exe 4880 cmd.exe 4612 cmd.exe 5964 cmd.exe 4288 cmd.exe 4476 cmd.exe 2296 cmd.exe 4088 cmd.exe 4916 cmd.exe 3476 cmd.exe 5728 cmd.exe 4620 cmd.exe 4580 cmd.exe 2108 cmd.exe 1752 cmd.exe 5688 cmd.exe 1200 cmd.exe 2636 cmd.exe 4644 cmd.exe 4364 cmd.exe 5608 cmd.exe 6028 cmd.exe 800 cmd.exe 1880 cmd.exe 4372 cmd.exe 3392 cmd.exe 4260 cmd.exe 1944 cmd.exe 5144 cmd.exe 4432 cmd.exe 1328 cmd.exe 6104 cmd.exe 3116 cmd.exe 3992 cmd.exe 1804 cmd.exe 3412 cmd.exe 1496 cmd.exe 260 cmd.exe - Program crash 1 IoCs
pid pid_target Process procid_target 1808 1852 WerFault.exe 92 - Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname Logo1_.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain Logo1_.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname Logo1_.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain Logo1_.exe - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe - Runs net.exe
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4116 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe 4116 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe 4116 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe 4116 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe 4116 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe 4116 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe 4116 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe 4116 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe 4116 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe 4116 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe 4116 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe 4116 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe 4116 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe 4116 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe 4116 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe 4116 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe 4116 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe 4116 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe 1852 Logo1_.exe 1852 Logo1_.exe 1852 Logo1_.exe 1852 Logo1_.exe 1852 Logo1_.exe 1852 Logo1_.exe 1852 Logo1_.exe 1852 Logo1_.exe 1852 Logo1_.exe 1852 Logo1_.exe 1852 Logo1_.exe 1852 Logo1_.exe 1852 Logo1_.exe 1852 Logo1_.exe 1852 Logo1_.exe 1852 Logo1_.exe 1852 Logo1_.exe 1852 Logo1_.exe 1852 Logo1_.exe 1852 Logo1_.exe 1852 Logo1_.exe 1852 Logo1_.exe 1852 Logo1_.exe 1852 Logo1_.exe 1852 Logo1_.exe 1852 Logo1_.exe 1852 Logo1_.exe 1852 Logo1_.exe 1852 Logo1_.exe 1852 Logo1_.exe 1852 Logo1_.exe 1852 Logo1_.exe 1852 Logo1_.exe 1852 Logo1_.exe 1852 Logo1_.exe 1852 Logo1_.exe 1852 Logo1_.exe 1852 Logo1_.exe 1852 Logo1_.exe 1852 Logo1_.exe 1852 Logo1_.exe 1852 Logo1_.exe 1852 Logo1_.exe 1852 Logo1_.exe 5388 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe 5388 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4116 wrote to memory of 3412 4116 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe 90 PID 4116 wrote to memory of 1852 4116 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe 92 PID 1852 wrote to memory of 4848 1852 Logo1_.exe 93 PID 4848 wrote to memory of 3288 4848 net.exe 95 PID 3412 wrote to memory of 5900 3412 cmd.exe 96 PID 5900 wrote to memory of 2756 5900 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe 97 PID 2756 wrote to memory of 1536 2756 cmd.exe 99 PID 1536 wrote to memory of 4104 1536 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe 100 PID 4104 wrote to memory of 960 4104 cmd.exe 102 PID 960 wrote to memory of 1424 960 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe 103 PID 1424 wrote to memory of 4592 1424 cmd.exe 105 PID 4592 wrote to memory of 1944 4592 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe 106 PID 1944 wrote to memory of 5736 1944 cmd.exe 108 PID 5736 wrote to memory of 3748 5736 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe 109 PID 3748 wrote to memory of 5308 3748 cmd.exe 111 PID 3352 wrote to memory of 5388 3352 cmd.exe 117 PID 5388 wrote to memory of 3888 5388 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe 118 PID 5388 wrote to memory of 540 5388 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe 119 PID 540 wrote to memory of 1696 540 Logo1_.exe 121 PID 1696 wrote to memory of 1120 1696 net.exe 123 PID 3888 wrote to memory of 4428 3888 cmd.exe 124 PID 4428 wrote to memory of 2052 4428 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe 125 PID 2052 wrote to memory of 5936 2052 cmd.exe 127 PID 5936 wrote to memory of 2272 5936 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe 128 PID 2272 wrote to memory of 3424 2272 cmd.exe 130 PID 3424 wrote to memory of 800 3424 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe 131 PID 800 wrote to memory of 4360 800 cmd.exe 133 PID 4360 wrote to memory of 4824 4360 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe 134 PID 4824 wrote to memory of 6112 4824 cmd.exe 136 PID 6112 wrote to memory of 1188 6112 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe 137 PID 1188 wrote to memory of 5940 1188 cmd.exe 139 PID 5940 wrote to memory of 4120 5940 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe 140 PID 4120 wrote to memory of 1400 4120 cmd.exe 142 PID 1400 wrote to memory of 1904 1400 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe 143 PID 1904 wrote to memory of 1836 1904 cmd.exe 145 PID 1836 wrote to memory of 1416 1836 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe 146 PID 1416 wrote to memory of 5876 1416 cmd.exe 148 PID 5876 wrote to memory of 5380 5876 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe 149 PID 5380 wrote to memory of 1884 5380 cmd.exe 151 PID 1884 wrote to memory of 1392 1884 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe 152 PID 1392 wrote to memory of 2060 1392 cmd.exe 154 PID 2060 wrote to memory of 5432 2060 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe 155 PID 5432 wrote to memory of 2888 5432 cmd.exe 157 PID 2888 wrote to memory of 4704 2888 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe 158 PID 4704 wrote to memory of 1108 4704 cmd.exe 160 PID 1108 wrote to memory of 1240 1108 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe 161 PID 1240 wrote to memory of 760 1240 cmd.exe 163 PID 760 wrote to memory of 2804 760 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe 164 PID 2804 wrote to memory of 2492 2804 cmd.exe 166 PID 2492 wrote to memory of 1344 2492 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe 167 PID 1344 wrote to memory of 2812 1344 cmd.exe 169 PID 2812 wrote to memory of 3808 2812 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe 170 PID 3808 wrote to memory of 2428 3808 cmd.exe 172 PID 2428 wrote to memory of 1540 2428 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe 173 PID 1540 wrote to memory of 4316 1540 cmd.exe 175 PID 4316 wrote to memory of 1388 4316 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe 176 PID 1388 wrote to memory of 4876 1388 cmd.exe 178 PID 4876 wrote to memory of 1808 4876 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe 179 PID 1808 wrote to memory of 2536 1808 cmd.exe 181 PID 2536 wrote to memory of 1200 2536 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe 182 PID 1200 wrote to memory of 3544 1200 cmd.exe 184 PID 3544 wrote to memory of 4540 3544 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe 185 PID 4540 wrote to memory of 4152 4540 cmd.exe 187 PID 4152 wrote to memory of 5584 4152 3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe 188
Processes
-
C:\Users\Admin\AppData\Local\Temp\3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe"C:\Users\Admin\AppData\Local\Temp\3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4116 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF085.bat2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3412 -
C:\Users\Admin\AppData\Local\Temp\3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe"C:\Users\Admin\AppData\Local\Temp\3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe"3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:5900 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF392.bat4⤵
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe"C:\Users\Admin\AppData\Local\Temp\3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe"5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1536 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF911.bat6⤵
- Suspicious use of WriteProcessMemory
PID:4104 -
C:\Users\Admin\AppData\Local\Temp\3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe"C:\Users\Admin\AppData\Local\Temp\3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:960 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFCE9.bat8⤵
- Suspicious use of WriteProcessMemory
PID:1424 -
C:\Users\Admin\AppData\Local\Temp\3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe"C:\Users\Admin\AppData\Local\Temp\3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe"9⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4592 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF0.bat10⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe"C:\Users\Admin\AppData\Local\Temp\3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe"11⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:5736 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4A9.bat12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3748 -
C:\Users\Admin\AppData\Local\Temp\3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe"C:\Users\Admin\AppData\Local\Temp\3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe"13⤵
- Executes dropped EXE
PID:5308 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA85.bat14⤵
- Suspicious use of WriteProcessMemory
PID:3352 -
C:\Users\Admin\AppData\Local\Temp\3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe"C:\Users\Admin\AppData\Local\Temp\3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe"15⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5388 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF58.bat16⤵
- Suspicious use of WriteProcessMemory
PID:3888 -
C:\Users\Admin\AppData\Local\Temp\3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe"C:\Users\Admin\AppData\Local\Temp\3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4428 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a117B.bat18⤵
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe"C:\Users\Admin\AppData\Local\Temp\3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5936 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a160F.bat20⤵
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe"C:\Users\Admin\AppData\Local\Temp\3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3424 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a19D7.bat22⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:800 -
C:\Users\Admin\AppData\Local\Temp\3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe"C:\Users\Admin\AppData\Local\Temp\3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4360 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1E2D.bat24⤵
- Suspicious use of WriteProcessMemory
PID:4824 -
C:\Users\Admin\AppData\Local\Temp\3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe"C:\Users\Admin\AppData\Local\Temp\3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6112 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2428.bat26⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1188 -
C:\Users\Admin\AppData\Local\Temp\3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe"C:\Users\Admin\AppData\Local\Temp\3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5940 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a260C.bat28⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4120 -
C:\Users\Admin\AppData\Local\Temp\3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe"C:\Users\Admin\AppData\Local\Temp\3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe"29⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1400 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2A42.bat30⤵
- Suspicious use of WriteProcessMemory
PID:1904 -
C:\Users\Admin\AppData\Local\Temp\3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe"C:\Users\Admin\AppData\Local\Temp\3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1836 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2E79.bat32⤵
- Suspicious use of WriteProcessMemory
PID:1416 -
C:\Users\Admin\AppData\Local\Temp\3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe"C:\Users\Admin\AppData\Local\Temp\3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5876 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a328F.bat34⤵
- Suspicious use of WriteProcessMemory
PID:5380 -
C:\Users\Admin\AppData\Local\Temp\3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe"C:\Users\Admin\AppData\Local\Temp\3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe"35⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1884 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a35CC.bat36⤵
- Suspicious use of WriteProcessMemory
PID:1392 -
C:\Users\Admin\AppData\Local\Temp\3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe"C:\Users\Admin\AppData\Local\Temp\3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3994.bat38⤵
- Suspicious use of WriteProcessMemory
PID:5432 -
C:\Users\Admin\AppData\Local\Temp\3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe"C:\Users\Admin\AppData\Local\Temp\3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3DAB.bat40⤵
- Suspicious use of WriteProcessMemory
PID:4704 -
C:\Users\Admin\AppData\Local\Temp\3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe"C:\Users\Admin\AppData\Local\Temp\3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1108 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4164.bat42⤵
- Suspicious use of WriteProcessMemory
PID:1240 -
C:\Users\Admin\AppData\Local\Temp\3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe"C:\Users\Admin\AppData\Local\Temp\3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:760 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a429D.bat44⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe"C:\Users\Admin\AppData\Local\Temp\3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2492 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a43D5.bat46⤵
- Suspicious use of WriteProcessMemory
PID:1344 -
C:\Users\Admin\AppData\Local\Temp\3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe"C:\Users\Admin\AppData\Local\Temp\3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe"47⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a452D.bat48⤵
- Suspicious use of WriteProcessMemory
PID:3808 -
C:\Users\Admin\AppData\Local\Temp\3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe"C:\Users\Admin\AppData\Local\Temp\3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe"49⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4637.bat50⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1540 -
C:\Users\Admin\AppData\Local\Temp\3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe"C:\Users\Admin\AppData\Local\Temp\3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4316 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a478E.bat52⤵
- Suspicious use of WriteProcessMemory
PID:1388 -
C:\Users\Admin\AppData\Local\Temp\3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe"C:\Users\Admin\AppData\Local\Temp\3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe"53⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4915.bat54⤵
- Suspicious use of WriteProcessMemory
PID:1808 -
C:\Users\Admin\AppData\Local\Temp\3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe"C:\Users\Admin\AppData\Local\Temp\3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe"55⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4A5D.bat56⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe"C:\Users\Admin\AppData\Local\Temp\3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3544 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4B67.bat58⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4540 -
C:\Users\Admin\AppData\Local\Temp\3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe"C:\Users\Admin\AppData\Local\Temp\3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe"59⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4152 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4C90.bat60⤵PID:5584
-
C:\Users\Admin\AppData\Local\Temp\3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe"C:\Users\Admin\AppData\Local\Temp\3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe"61⤵
- Executes dropped EXE
PID:5528 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4D8A.bat62⤵
- Executes a command shell one-liner
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe"C:\Users\Admin\AppData\Local\Temp\3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe"63⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4828 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4E93.bat64⤵PID:2532
-
C:\Users\Admin\AppData\Local\Temp\3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe"C:\Users\Admin\AppData\Local\Temp\3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe"65⤵
- Executes dropped EXE
PID:1528 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4FBC.bat66⤵PID:6116
-
C:\Users\Admin\AppData\Local\Temp\3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe"C:\Users\Admin\AppData\Local\Temp\3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe"67⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5980 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5114.bat68⤵
- System Location Discovery: System Language Discovery
PID:1992 -
C:\Users\Admin\AppData\Local\Temp\3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe"C:\Users\Admin\AppData\Local\Temp\3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe"69⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1980 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a522D.bat70⤵
- System Location Discovery: System Language Discovery
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe"C:\Users\Admin\AppData\Local\Temp\3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe"71⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3060 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5375.bat72⤵PID:5396
-
C:\Users\Admin\AppData\Local\Temp\3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe"C:\Users\Admin\AppData\Local\Temp\3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe"73⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:6060 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a54BD.bat74⤵PID:5992
-
C:\Users\Admin\AppData\Local\Temp\3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe"C:\Users\Admin\AppData\Local\Temp\3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe"75⤵
- Executes dropped EXE
PID:3172 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a55C7.bat76⤵
- System Location Discovery: System Language Discovery
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe"C:\Users\Admin\AppData\Local\Temp\3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe"77⤵
- Executes dropped EXE
PID:5636 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5700.bat78⤵PID:5852
-
C:\Users\Admin\AppData\Local\Temp\3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe"C:\Users\Admin\AppData\Local\Temp\3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe"79⤵
- Executes dropped EXE
PID:3872 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5848.bat80⤵PID:3816
-
C:\Users\Admin\AppData\Local\Temp\3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe"C:\Users\Admin\AppData\Local\Temp\3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe"81⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5920 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5961.bat82⤵PID:3764
-
C:\Users\Admin\AppData\Local\Temp\3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe"C:\Users\Admin\AppData\Local\Temp\3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe"83⤵
- Executes dropped EXE
PID:4184 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5A5B.bat84⤵PID:4652
-
C:\Users\Admin\AppData\Local\Temp\3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe"C:\Users\Admin\AppData\Local\Temp\3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe"85⤵
- Executes dropped EXE
PID:3088 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5B65.bat86⤵PID:520
-
C:\Users\Admin\AppData\Local\Temp\3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe"C:\Users\Admin\AppData\Local\Temp\3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe"87⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:832 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5C8D.bat88⤵PID:1680
-
C:\Users\Admin\AppData\Local\Temp\3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe"C:\Users\Admin\AppData\Local\Temp\3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe"89⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:6092 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5DA7.bat90⤵PID:6088
-
C:\Users\Admin\AppData\Local\Temp\3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe"C:\Users\Admin\AppData\Local\Temp\3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe"91⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3760 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5ED0.bat92⤵PID:5916
-
C:\Users\Admin\AppData\Local\Temp\3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe"C:\Users\Admin\AppData\Local\Temp\3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe"93⤵
- Executes dropped EXE
PID:2440 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5FF8.bat94⤵PID:3080
-
C:\Users\Admin\AppData\Local\Temp\3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe"C:\Users\Admin\AppData\Local\Temp\3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe"95⤵
- Executes dropped EXE
PID:5524 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6131.bat96⤵PID:480
-
C:\Users\Admin\AppData\Local\Temp\3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe"C:\Users\Admin\AppData\Local\Temp\3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe"97⤵
- Executes dropped EXE
PID:5420 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a621B.bat98⤵PID:2880
-
C:\Users\Admin\AppData\Local\Temp\3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe"C:\Users\Admin\AppData\Local\Temp\3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe"99⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3444 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6392.bat100⤵PID:5196
-
C:\Users\Admin\AppData\Local\Temp\3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe"C:\Users\Admin\AppData\Local\Temp\3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe"101⤵
- Executes dropped EXE
PID:2116 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a64AC.bat102⤵PID:4672
-
C:\Users\Admin\AppData\Local\Temp\3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe"C:\Users\Admin\AppData\Local\Temp\3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe"103⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5868 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a65A6.bat104⤵
- Executes a command shell one-liner
PID:3152 -
C:\Users\Admin\AppData\Local\Temp\3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe"C:\Users\Admin\AppData\Local\Temp\3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe"105⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2772 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a66BF.bat106⤵PID:3356
-
C:\Users\Admin\AppData\Local\Temp\3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe"C:\Users\Admin\AppData\Local\Temp\3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe"107⤵
- Executes dropped EXE
PID:1284 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a67C8.bat108⤵
- Executes a command shell one-liner
PID:1880 -
C:\Users\Admin\AppData\Local\Temp\3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe"C:\Users\Admin\AppData\Local\Temp\3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe"109⤵
- Executes dropped EXE
PID:2024 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a68E2.bat110⤵
- Executes a command shell one-liner
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe"C:\Users\Admin\AppData\Local\Temp\3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe"111⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:864 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a69FB.bat112⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe"C:\Users\Admin\AppData\Local\Temp\3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe"113⤵
- Executes dropped EXE
PID:2928 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6B14.bat114⤵PID:3472
-
C:\Users\Admin\AppData\Local\Temp\3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe"C:\Users\Admin\AppData\Local\Temp\3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe"115⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3428 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6C0E.bat116⤵PID:4732
-
C:\Users\Admin\AppData\Local\Temp\3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe"C:\Users\Admin\AppData\Local\Temp\3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe"117⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1256 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6D18.bat118⤵PID:2348
-
C:\Users\Admin\AppData\Local\Temp\3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe"C:\Users\Admin\AppData\Local\Temp\3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe"119⤵
- Executes dropped EXE
PID:4936 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6E31.bat120⤵PID:4972
-
C:\Users\Admin\AppData\Local\Temp\3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe"C:\Users\Admin\AppData\Local\Temp\3c178fac5f50d1c5eb08a2049f111f7f08f234ff59c5bdce4b7e46666fc693a5.exe"121⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:984
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-