Analysis
- max time kernel
150s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/09/2026, 15:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
12 signatures
150 seconds
General
- Target 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe
- Size 6.5MB
- Sample260930-s2ps6aws4r
- SHA256 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216
- MD5 3a86899500dcf89162d11b35184b467c
- SHA1 9560a78cbec3d44f02702e685297285455d8d3b5
- SHA512 77fb466aab9ebf3e25c8e5db230d3cd33af2e2cf3a732d1473737c98e5ed22e4f0be8d784e46368d4473f0b1a36c2d0a894e45ebfa45e6c7e22c8e1a6a2d01c9
- SSDEEP 98304:iLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLL1:CjJr
- TLSH T1D466E18193D9A479E5C3163450B38FCBE7697461E7218B4F906402FDEDC02E5AE2AFB4
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4212 Logo1_.exe 1848 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe 3396 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe 260 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe 4912 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe 5328 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe 3116 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe 5968 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe 2608 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe 5032 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe 4636 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe 3704 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe 3280 Logo1_.exe 4560 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe 5760 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe 4984 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe 1852 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe 3584 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe 6064 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe 5944 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe 3248 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe 2996 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe 5908 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe 1204 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe 1048 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe 6120 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe 4552 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe 4788 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe 3892 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe 6016 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe 2404 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe 3536 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe 5640 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe 6044 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe 256 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe 2464 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe 4860 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe 5552 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe 3320 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe 4216 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe 2860 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe 3784 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe 3000 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe 4448 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe 2948 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe 5356 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe 2956 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe 5952 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe 2744 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe 5432 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe 3940 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe 4088 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe 2492 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe 2880 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe 4584 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe 5064 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe 3392 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe 2552 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe 1300 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe 1668 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe 3436 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe 460 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe 4140 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe 4576 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe - Enumerates connected drives 3 TTPs 44 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe \??\F:\ Logo1_.exe File opened (read-only) \??\D: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe \??\F:\ Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\D: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft.NET\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RMNSQUE\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\mk\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\Bibliography\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CONCRETE\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\plugins\misc\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\uk-UA\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\AXIS\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\de\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Resources\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\VBA\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE Logo1_.exe File created C:\Program Files\Microsoft Office\root\Office16\XLSTART\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ast\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\as_IN\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\zh_TW\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Internet Explorer\uk-UA\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\Office16\Library\Analysis\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\NETWORK\_desktop.ini Logo1_.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\fr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\stream_filter\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\uk-UA\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\sl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\DESIGNER\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ky\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\it-IT\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\it-IT\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk-1.8\bin\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\ECHO\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\cgg\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\it-IT\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\it\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\ar\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\plugins\packetizer\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\cs\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\de\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\SystemX86\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\es\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\am\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\Office16\Configuration\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Help\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\LISTS\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\meta_engine\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\hu\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\EDGE\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Filters\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office 15\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\bn\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\mk\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\_desktop.ini Logo1_.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\Logo1_.exe 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe File created C:\Windows\Logo1_.exe 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe File created C:\Windows\Logo1_.exe 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe File created C:\Windows\Logo1_.exe 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe File created C:\Windows\Logo1_.exe 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe File created C:\Windows\Logo1_.exe 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe File created C:\Windows\Logo1_.exe 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe File created C:\Windows\Logo1_.exe 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe File created C:\Windows\Logo1_.exe 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe File created C:\Windows\Logo1_.exe 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe File created C:\Windows\Logo1_.exe 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe File created C:\Windows\Logo1_.exe 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe File created C:\Windows\Logo1_.exe 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe File created C:\Windows\Logo1_.exe 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe File created C:\Windows\Logo1_.exe 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe File created C:\Windows\Logo1_.exe 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe File created C:\Windows\Logo1_.exe 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe File created C:\Windows\Logo1_.exe 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe File created C:\Windows\Logo1_.exe 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe File created C:\Windows\Logo1_.exe 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe File created C:\Windows\Logo1_.exe 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe File created C:\Windows\Logo1_.exe 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe File created C:\Windows\Logo1_.exe 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe File created C:\Windows\Logo1_.exe 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe File created C:\Windows\Dll.dll Logo1_.exe File created C:\Windows\Logo1_.exe 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe File created C:\Windows\Logo1_.exe 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe File created C:\Windows\Logo1_.exe 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe File created C:\Windows\Logo1_.exe 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe File created C:\Windows\Logo1_.exe 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe File created C:\Windows\Logo1_.exe 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe File created C:\Windows\Logo1_.exe 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe File created C:\Windows\Logo1_.exe 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe File created C:\Windows\Logo1_.exe 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe File created C:\Windows\Logo1_.exe 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe File created C:\Windows\Logo1_.exe 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe File created C:\Windows\Logo1_.exe 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe File created C:\Windows\Logo1_.exe 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe File created C:\Windows\Logo1_.exe 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe File created C:\Windows\Logo1_.exe 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe File created C:\Windows\Logo1_.exe 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe File created C:\Windows\Logo1_.exe 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe File created C:\Windows\Logo1_.exe 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe File created C:\Windows\Logo1_.exe 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe File created C:\Windows\Logo1_.exe 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe File created C:\Windows\Logo1_.exe 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe File created C:\Windows\Logo1_.exe 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe File created C:\Windows\Logo1_.exe 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe File created C:\Windows\Logo1_.exe 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe File created C:\Windows\Logo1_.exe 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe File created C:\Windows\Logo1_.exe 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe File created C:\Windows\Logo1_.exe 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe File opened for modification C:\Windows\Logo1_.exe 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\Logo1_.exe 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe File created C:\Windows\Logo1_.exe 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe File created C:\Windows\Logo1_.exe 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe File created C:\Windows\Logo1_.exe 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe File created C:\Windows\Logo1_.exe 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe File created C:\Windows\Logo1_.exe 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe File opened for modification C:\Windows\rundl132.exe 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe File created C:\Windows\Logo1_.exe 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe File created C:\Windows\Logo1_.exe 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe File created C:\Windows\Logo1_.exe 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe - Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4320 cmd.exe 4056 cmd.exe 5864 cmd.exe 3896 cmd.exe 4812 cmd.exe 2688 cmd.exe 2516 cmd.exe 3040 cmd.exe 1096 cmd.exe 4272 cmd.exe 6080 cmd.exe 4816 cmd.exe 3020 cmd.exe 804 cmd.exe 5160 cmd.exe 3724 cmd.exe 1964 cmd.exe 1868 cmd.exe 2852 cmd.exe 1112 cmd.exe 3372 cmd.exe 836 cmd.exe 6084 cmd.exe 5516 cmd.exe 2736 cmd.exe 4184 cmd.exe 1824 cmd.exe 3448 cmd.exe 4900 cmd.exe 1324 cmd.exe 4616 cmd.exe 2824 cmd.exe 2228 cmd.exe 3936 cmd.exe 3508 cmd.exe 5384 cmd.exe 2616 cmd.exe 2208 cmd.exe 2912 cmd.exe 264 cmd.exe 3324 cmd.exe 1376 cmd.exe 5880 cmd.exe 5468 cmd.exe 3944 cmd.exe 5580 cmd.exe 432 cmd.exe 4280 cmd.exe 4628 cmd.exe 3904 cmd.exe 3432 cmd.exe 244 cmd.exe 4112 cmd.exe 5244 cmd.exe 4512 cmd.exe 5156 cmd.exe 4980 cmd.exe 704 cmd.exe 5988 cmd.exe 3512 cmd.exe 4764 cmd.exe 4684 cmd.exe 3644 cmd.exe 5724 cmd.exe - Program crash 2 IoCs
pid pid_target Process procid_target 1960 4212 WerFault.exe 90 6132 4212 WerFault.exe 90 - Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain Logo1_.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname Logo1_.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain Logo1_.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname Logo1_.exe - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe - Runs net.exe
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5348 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe 5348 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe 5348 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe 5348 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe 5348 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe 5348 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe 5348 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe 5348 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe 5348 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe 5348 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe 5348 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe 5348 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe 5348 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe 5348 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe 5348 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe 5348 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe 5348 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe 5348 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe 4212 Logo1_.exe 4212 Logo1_.exe 4212 Logo1_.exe 4212 Logo1_.exe 4212 Logo1_.exe 4212 Logo1_.exe 4212 Logo1_.exe 4212 Logo1_.exe 4212 Logo1_.exe 4212 Logo1_.exe 4212 Logo1_.exe 4212 Logo1_.exe 4212 Logo1_.exe 4212 Logo1_.exe 4212 Logo1_.exe 4212 Logo1_.exe 4212 Logo1_.exe 4212 Logo1_.exe 4212 Logo1_.exe 4212 Logo1_.exe 4212 Logo1_.exe 4212 Logo1_.exe 4212 Logo1_.exe 4212 Logo1_.exe 4212 Logo1_.exe 4212 Logo1_.exe 4212 Logo1_.exe 4212 Logo1_.exe 4212 Logo1_.exe 4212 Logo1_.exe 4212 Logo1_.exe 4212 Logo1_.exe 4212 Logo1_.exe 4212 Logo1_.exe 4212 Logo1_.exe 4212 Logo1_.exe 4212 Logo1_.exe 4212 Logo1_.exe 4212 Logo1_.exe 4212 Logo1_.exe 4212 Logo1_.exe 4212 Logo1_.exe 4212 Logo1_.exe 4212 Logo1_.exe 3704 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe 3704 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5348 wrote to memory of 1200 5348 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe 89 PID 5348 wrote to memory of 4212 5348 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe 90 PID 4212 wrote to memory of 2884 4212 Logo1_.exe 91 PID 2884 wrote to memory of 4636 2884 net.exe 93 PID 1200 wrote to memory of 1848 1200 cmd.exe 95 PID 1848 wrote to memory of 3944 1848 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe 96 PID 3944 wrote to memory of 3396 3944 cmd.exe 98 PID 3396 wrote to memory of 3308 3396 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe 99 PID 3308 wrote to memory of 260 3308 cmd.exe 101 PID 260 wrote to memory of 5480 260 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe 102 PID 5480 wrote to memory of 4912 5480 cmd.exe 104 PID 4912 wrote to memory of 2444 4912 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe 105 PID 2444 wrote to memory of 5328 2444 cmd.exe 107 PID 5328 wrote to memory of 4544 5328 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe 108 PID 4544 wrote to memory of 3116 4544 cmd.exe 110 PID 3116 wrote to memory of 3688 3116 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe 111 PID 3688 wrote to memory of 5968 3688 cmd.exe 113 PID 5968 wrote to memory of 2824 5968 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe 114 PID 2824 wrote to memory of 2608 2824 cmd.exe 118 PID 2608 wrote to memory of 3036 2608 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe 120 PID 3036 wrote to memory of 5032 3036 cmd.exe 122 PID 5032 wrote to memory of 4812 5032 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe 123 PID 4812 wrote to memory of 4636 4812 cmd.exe 127 PID 4636 wrote to memory of 5056 4636 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe 128 PID 5056 wrote to memory of 3704 5056 cmd.exe 130 PID 3704 wrote to memory of 1112 3704 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe 131 PID 3704 wrote to memory of 3280 3704 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe 132 PID 3280 wrote to memory of 368 3280 Logo1_.exe 134 PID 368 wrote to memory of 4824 368 net.exe 136 PID 1112 wrote to memory of 4560 1112 cmd.exe 137 PID 4560 wrote to memory of 3460 4560 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe 138 PID 3460 wrote to memory of 5760 3460 cmd.exe 140 PID 5760 wrote to memory of 4764 5760 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe 141 PID 4764 wrote to memory of 4984 4764 cmd.exe 143 PID 4984 wrote to memory of 2632 4984 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe 144 PID 2632 wrote to memory of 1852 2632 cmd.exe 146 PID 1852 wrote to memory of 5580 1852 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe 147 PID 5580 wrote to memory of 3584 5580 cmd.exe 149 PID 3584 wrote to memory of 3304 3584 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe 150 PID 3304 wrote to memory of 6064 3304 cmd.exe 152 PID 6064 wrote to memory of 2688 6064 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe 153 PID 2688 wrote to memory of 5944 2688 cmd.exe 155 PID 5944 wrote to memory of 432 5944 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe 156 PID 432 wrote to memory of 3248 432 cmd.exe 158 PID 3248 wrote to memory of 3224 3248 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe 159 PID 3224 wrote to memory of 2996 3224 cmd.exe 161 PID 2996 wrote to memory of 4980 2996 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe 162 PID 4980 wrote to memory of 5908 4980 cmd.exe 164 PID 5908 wrote to memory of 2280 5908 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe 165 PID 2280 wrote to memory of 1204 2280 cmd.exe 167 PID 1204 wrote to memory of 3352 1204 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe 168 PID 3352 wrote to memory of 1048 3352 cmd.exe 170 PID 1048 wrote to memory of 5692 1048 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe 171 PID 5692 wrote to memory of 6120 5692 cmd.exe 173 PID 6120 wrote to memory of 4384 6120 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe 174 PID 4384 wrote to memory of 4552 4384 cmd.exe 176 PID 4552 wrote to memory of 2576 4552 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe 177 PID 2576 wrote to memory of 4788 2576 cmd.exe 179 PID 4788 wrote to memory of 4280 4788 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe 180 PID 4280 wrote to memory of 3892 4280 cmd.exe 182 PID 3892 wrote to memory of 4112 3892 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe 183 PID 4112 wrote to memory of 6016 4112 cmd.exe 185 PID 6016 wrote to memory of 5244 6016 108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe 186 PID 5244 wrote to memory of 2404 5244 cmd.exe 188
Processes
-
C:\Users\Admin\AppData\Local\Temp\108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe"C:\Users\Admin\AppData\Local\Temp\108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5348 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a21F5.bat2⤵
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe"C:\Users\Admin\AppData\Local\Temp\108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1848 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a28AC.bat4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3944 -
C:\Users\Admin\AppData\Local\Temp\108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe"C:\Users\Admin\AppData\Local\Temp\108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe"5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3396 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2B3C.bat6⤵
- Suspicious use of WriteProcessMemory
PID:3308 -
C:\Users\Admin\AppData\Local\Temp\108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe"C:\Users\Admin\AppData\Local\Temp\108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:260 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2EF6.bat8⤵
- Suspicious use of WriteProcessMemory
PID:5480 -
C:\Users\Admin\AppData\Local\Temp\108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe"C:\Users\Admin\AppData\Local\Temp\108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe"9⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4912 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a332C.bat10⤵
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\Users\Admin\AppData\Local\Temp\108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe"C:\Users\Admin\AppData\Local\Temp\108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe"11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5328 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a360A.bat12⤵
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\Users\Admin\AppData\Local\Temp\108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe"C:\Users\Admin\AppData\Local\Temp\108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3116 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a423F.bat14⤵
- Suspicious use of WriteProcessMemory
PID:3688 -
C:\Users\Admin\AppData\Local\Temp\108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe"C:\Users\Admin\AppData\Local\Temp\108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5968 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a45BA.bat16⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe"C:\Users\Admin\AppData\Local\Temp\108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe"17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4A8C.bat18⤵
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe"C:\Users\Admin\AppData\Local\Temp\108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5032 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4E16.bat20⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4812 -
C:\Users\Admin\AppData\Local\Temp\108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe"C:\Users\Admin\AppData\Local\Temp\108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe"21⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a520E.bat22⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5056 -
C:\Users\Admin\AppData\Local\Temp\108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe"C:\Users\Admin\AppData\Local\Temp\108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe"23⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3704 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5589.bat24⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1112 -
C:\Users\Admin\AppData\Local\Temp\108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe"C:\Users\Admin\AppData\Local\Temp\108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe"25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4560 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5932.bat26⤵
- Suspicious use of WriteProcessMemory
PID:3460 -
C:\Users\Admin\AppData\Local\Temp\108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe"C:\Users\Admin\AppData\Local\Temp\108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe"27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5760 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5E14.bat28⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\Users\Admin\AppData\Local\Temp\108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe"C:\Users\Admin\AppData\Local\Temp\108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe"29⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a64BB.bat30⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe"C:\Users\Admin\AppData\Local\Temp\108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe"31⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1852 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6B72.bat32⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5580 -
C:\Users\Admin\AppData\Local\Temp\108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe"C:\Users\Admin\AppData\Local\Temp\108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3584 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a718C.bat34⤵
- Suspicious use of WriteProcessMemory
PID:3304 -
C:\Users\Admin\AppData\Local\Temp\108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe"C:\Users\Admin\AppData\Local\Temp\108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6064 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7834.bat36⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe"C:\Users\Admin\AppData\Local\Temp\108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe"37⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5944 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7FF4.bat38⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:432 -
C:\Users\Admin\AppData\Local\Temp\108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe"C:\Users\Admin\AppData\Local\Temp\108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe"39⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3248 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8851.bat40⤵
- Suspicious use of WriteProcessMemory
PID:3224 -
C:\Users\Admin\AppData\Local\Temp\108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe"C:\Users\Admin\AppData\Local\Temp\108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a894B.bat42⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4980 -
C:\Users\Admin\AppData\Local\Temp\108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe"C:\Users\Admin\AppData\Local\Temp\108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe"43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5908 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8A35.bat44⤵
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe"C:\Users\Admin\AppData\Local\Temp\108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1204 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8B2F.bat46⤵
- Suspicious use of WriteProcessMemory
PID:3352 -
C:\Users\Admin\AppData\Local\Temp\108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe"C:\Users\Admin\AppData\Local\Temp\108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1048 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8C39.bat48⤵
- Suspicious use of WriteProcessMemory
PID:5692 -
C:\Users\Admin\AppData\Local\Temp\108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe"C:\Users\Admin\AppData\Local\Temp\108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe"49⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6120 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8D42.bat50⤵
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\Users\Admin\AppData\Local\Temp\108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe"C:\Users\Admin\AppData\Local\Temp\108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4552 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8E2D.bat52⤵
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe"C:\Users\Admin\AppData\Local\Temp\108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4788 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8F27.bat54⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4280 -
C:\Users\Admin\AppData\Local\Temp\108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe"C:\Users\Admin\AppData\Local\Temp\108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe"55⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3892 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9040.bat56⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4112 -
C:\Users\Admin\AppData\Local\Temp\108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe"C:\Users\Admin\AppData\Local\Temp\108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6016 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9198.bat58⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5244 -
C:\Users\Admin\AppData\Local\Temp\108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe"C:\Users\Admin\AppData\Local\Temp\108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe"59⤵
- Executes dropped EXE
PID:2404 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9292.bat60⤵
- Executes a command shell one-liner
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe"C:\Users\Admin\AppData\Local\Temp\108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe"61⤵
- Executes dropped EXE
PID:3536 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a93CA.bat62⤵
- Executes a command shell one-liner
PID:4684 -
C:\Users\Admin\AppData\Local\Temp\108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe"C:\Users\Admin\AppData\Local\Temp\108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe"63⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5640 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a94B4.bat64⤵
- Executes a command shell one-liner
PID:4900 -
C:\Users\Admin\AppData\Local\Temp\108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe"C:\Users\Admin\AppData\Local\Temp\108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe"65⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:6044 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a95CE.bat66⤵PID:3532
-
C:\Users\Admin\AppData\Local\Temp\108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe"C:\Users\Admin\AppData\Local\Temp\108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe"67⤵
- Executes dropped EXE
PID:256 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a96B8.bat68⤵PID:4588
-
C:\Users\Admin\AppData\Local\Temp\108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe"C:\Users\Admin\AppData\Local\Temp\108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe"69⤵
- Executes dropped EXE
PID:2464 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9793.bat70⤵PID:4500
-
C:\Users\Admin\AppData\Local\Temp\108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe"C:\Users\Admin\AppData\Local\Temp\108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe"71⤵
- Executes dropped EXE
PID:4860 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a987D.bat72⤵
- Executes a command shell one-liner
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe"C:\Users\Admin\AppData\Local\Temp\108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe"73⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5552 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9977.bat74⤵PID:1160
-
C:\Users\Admin\AppData\Local\Temp\108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe"C:\Users\Admin\AppData\Local\Temp\108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe"75⤵
- Executes dropped EXE
PID:3320 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9A52.bat76⤵PID:4832
-
C:\Users\Admin\AppData\Local\Temp\108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe"C:\Users\Admin\AppData\Local\Temp\108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe"77⤵
- Executes dropped EXE
PID:4216 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9B4C.bat78⤵PID:3136
-
C:\Users\Admin\AppData\Local\Temp\108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe"C:\Users\Admin\AppData\Local\Temp\108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe"79⤵
- Executes dropped EXE
PID:2860 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9C36.bat80⤵
- Executes a command shell one-liner
PID:3372 -
C:\Users\Admin\AppData\Local\Temp\108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe"C:\Users\Admin\AppData\Local\Temp\108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe"81⤵
- Executes dropped EXE
PID:3784 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9D40.bat82⤵PID:1520
-
C:\Users\Admin\AppData\Local\Temp\108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe"C:\Users\Admin\AppData\Local\Temp\108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe"83⤵
- Executes dropped EXE
PID:3000 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9E1B.bat84⤵PID:3740
-
C:\Users\Admin\AppData\Local\Temp\108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe"C:\Users\Admin\AppData\Local\Temp\108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe"85⤵
- Executes dropped EXE
PID:4448 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9EE6.bat86⤵
- Executes a command shell one-liner
PID:4628 -
C:\Users\Admin\AppData\Local\Temp\108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe"C:\Users\Admin\AppData\Local\Temp\108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe"87⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2948 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA00F.bat88⤵PID:3220
-
C:\Users\Admin\AppData\Local\Temp\108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe"C:\Users\Admin\AppData\Local\Temp\108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe"89⤵
- Executes dropped EXE
PID:5356 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA128.bat90⤵PID:3628
-
C:\Users\Admin\AppData\Local\Temp\108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe"C:\Users\Admin\AppData\Local\Temp\108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe"91⤵
- Executes dropped EXE
PID:2956 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA251.bat92⤵PID:2932
-
C:\Users\Admin\AppData\Local\Temp\108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe"C:\Users\Admin\AppData\Local\Temp\108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe"93⤵
- Executes dropped EXE
PID:5952 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA34B.bat94⤵PID:4856
-
C:\Users\Admin\AppData\Local\Temp\108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe"C:\Users\Admin\AppData\Local\Temp\108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe"95⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2744 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA445.bat96⤵PID:1280
-
C:\Users\Admin\AppData\Local\Temp\108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe"C:\Users\Admin\AppData\Local\Temp\108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe"97⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5432 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA520.bat98⤵
- Executes a command shell one-liner
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe"C:\Users\Admin\AppData\Local\Temp\108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe"99⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3940 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA639.bat100⤵PID:5504
-
C:\Users\Admin\AppData\Local\Temp\108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe"C:\Users\Admin\AppData\Local\Temp\108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe"101⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4088 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA704.bat102⤵PID:1552
-
C:\Users\Admin\AppData\Local\Temp\108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe"C:\Users\Admin\AppData\Local\Temp\108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe"103⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2492 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA7FE.bat104⤵PID:4100
-
C:\Users\Admin\AppData\Local\Temp\108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe"C:\Users\Admin\AppData\Local\Temp\108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe"105⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2880 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA8C9.bat106⤵PID:4392
-
C:\Users\Admin\AppData\Local\Temp\108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe"C:\Users\Admin\AppData\Local\Temp\108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe"107⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4584 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA9C3.bat108⤵
- Executes a command shell one-liner
PID:1324 -
C:\Users\Admin\AppData\Local\Temp\108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe"C:\Users\Admin\AppData\Local\Temp\108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe"109⤵
- Executes dropped EXE
PID:5064 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAA9E.bat110⤵PID:4404
-
C:\Users\Admin\AppData\Local\Temp\108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe"C:\Users\Admin\AppData\Local\Temp\108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe"111⤵
- Executes dropped EXE
PID:3392 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAB69.bat112⤵
- Executes a command shell one-liner
PID:3644 -
C:\Users\Admin\AppData\Local\Temp\108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe"C:\Users\Admin\AppData\Local\Temp\108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe"113⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2552 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAC44.bat114⤵
- Executes a command shell one-liner
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe"C:\Users\Admin\AppData\Local\Temp\108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe"115⤵
- Executes dropped EXE
PID:1300 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAD4D.bat116⤵PID:1600
-
C:\Users\Admin\AppData\Local\Temp\108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe"C:\Users\Admin\AppData\Local\Temp\108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe"117⤵
- Executes dropped EXE
PID:1668 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAE38.bat118⤵PID:1352
-
C:\Users\Admin\AppData\Local\Temp\108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe"C:\Users\Admin\AppData\Local\Temp\108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe"119⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3436 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAF51.bat120⤵PID:2940
-
C:\Users\Admin\AppData\Local\Temp\108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe"C:\Users\Admin\AppData\Local\Temp\108f781724306b67847923a696a82b5bdad64a96c31532c033e18882eb865216.exe"121⤵
- Executes dropped EXE
PID:460
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-