9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58

Analysis

max time kernel
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/10/2026, 00:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
Size 3.1MB
Sample261017-a2rnmsfs5p
SHA256 9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58
MD5 01aadafdba42b90f53297c372ba50bc5
SHA1 1cb0aac914741d04bbcd7971a301e524d18afb7b
SHA512 2a8eab71517452ac759e8fafac998245e2171b1ddb6d339122772650af73353d89ed3da5117c06d417a2c5837a8daba4f0e26154144daa763c46d3842a48d58b
SSDEEP 98304:iLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLt:CjJz
TLSH
T176E5E181A3D99435E5C3163450B28FCFE7697861E7218B8F916402FDEDD02E1AE29FB4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
1484	Logo1_.exe
600	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
4796	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
2444	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
3252	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
4352	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
2628	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
1176	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
4112	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
3324	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
1144	Logo1_.exe
4380	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
5048	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
1540	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
5808	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
5528	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
5768	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
4300	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
5584	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
5580	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
4464	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
5904	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
4176	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
4664	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
1316	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
5864	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
3868	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
5256	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
4888	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
3148	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
4160	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
4060	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
4256	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
2960	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
2932	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
5512	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
2132	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
5736	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
3272	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
5932	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
1428	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
5848	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
4616	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
6112	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
5156	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
1660	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
5360	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
4156	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
2948	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
3428	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
5344	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
5556	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
5112	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
2264	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
5836	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
1252	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
1320	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
5940	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
2908	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
4604	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
716	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
4900	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
3216	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
4672	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe

Enumerates connected drives 3 TTPs 42 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\D:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\D:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\Logo1_.exe	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
File created	C:\Windows\Logo1_.exe	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
File created	C:\Windows\Logo1_.exe	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
File created	C:\Windows\Logo1_.exe	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
File created	C:\Windows\Logo1_.exe	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
File created	C:\Windows\Logo1_.exe	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
File created	C:\Windows\Logo1_.exe	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
File created	C:\Windows\Logo1_.exe	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
File created	C:\Windows\Logo1_.exe	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
File created	C:\Windows\Logo1_.exe	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
File created	C:\Windows\Logo1_.exe	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
File created	C:\Windows\Logo1_.exe	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
File created	C:\Windows\Logo1_.exe	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
File created	C:\Windows\Logo1_.exe	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
File created	C:\Windows\Logo1_.exe	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
File created	C:\Windows\Logo1_.exe	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
File created	C:\Windows\Logo1_.exe	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
File created	C:\Windows\Logo1_.exe	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
File created	C:\Windows\Logo1_.exe	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
File created	C:\Windows\Logo1_.exe	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
File created	C:\Windows\Logo1_.exe	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\Logo1_.exe	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
File created	C:\Windows\Logo1_.exe	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
File created	C:\Windows\Logo1_.exe	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
File created	C:\Windows\Logo1_.exe	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
File created	C:\Windows\Logo1_.exe	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
File created	C:\Windows\Logo1_.exe	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
File created	C:\Windows\Logo1_.exe	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
File created	C:\Windows\Logo1_.exe	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
File created	C:\Windows\Logo1_.exe	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
File created	C:\Windows\Logo1_.exe	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
File created	C:\Windows\Logo1_.exe	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
File opened for modification	C:\Windows\Logo1_.exe	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
File created	C:\Windows\Logo1_.exe	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
File created	C:\Windows\Logo1_.exe	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
File created	C:\Windows\Logo1_.exe	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
File created	C:\Windows\Logo1_.exe	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
File created	C:\Windows\Logo1_.exe	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
File created	C:\Windows\Logo1_.exe	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
File created	C:\Windows\Logo1_.exe	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
File created	C:\Windows\Logo1_.exe	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
File created	C:\Windows\Logo1_.exe	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
File opened for modification	C:\Windows\rundl132.exe	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
File created	C:\Windows\Logo1_.exe	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
File created	C:\Windows\Logo1_.exe	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
File created	C:\Windows\Logo1_.exe	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
File created	C:\Windows\Logo1_.exe	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
File created	C:\Windows\Logo1_.exe	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
File created	C:\Windows\Logo1_.exe	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
File created	C:\Windows\Logo1_.exe	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\Logo1_.exe	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
File created	C:\Windows\Logo1_.exe	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
File created	C:\Windows\Logo1_.exe	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
File created	C:\Windows\Logo1_.exe	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
File created	C:\Windows\Logo1_.exe	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
File created	C:\Windows\Logo1_.exe	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
File created	C:\Windows\rundl132.exe	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
File created	C:\Windows\Dll.dll	Logo1_.exe
File created	C:\Windows\Logo1_.exe	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
File created	C:\Windows\Logo1_.exe	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
File created	C:\Windows\Logo1_.exe	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
File created	C:\Windows\Logo1_.exe	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe

Executes a command shell one-liner 1 TTPs 64 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
624	cmd.exe
4636	cmd.exe
4992	cmd.exe
5740	cmd.exe
5964	cmd.exe
1056	cmd.exe
5792	cmd.exe
4820	cmd.exe
1376	cmd.exe
5444	cmd.exe
5124	cmd.exe
2964	cmd.exe
3376	cmd.exe
2216	cmd.exe
2016	cmd.exe
2164	cmd.exe
5200	cmd.exe
3372	cmd.exe
2996	cmd.exe
1836	cmd.exe
2304	cmd.exe
2516	cmd.exe
5640	cmd.exe
2736	cmd.exe
5024	cmd.exe
4772	cmd.exe
3756	cmd.exe
6004	cmd.exe
2212	cmd.exe
4708	cmd.exe
3860	cmd.exe
1276	cmd.exe
4080	cmd.exe
4696	cmd.exe
2364	cmd.exe
3520	cmd.exe
4108	cmd.exe
3392	cmd.exe
3444	cmd.exe
1856	cmd.exe
4388	cmd.exe
2052	cmd.exe
1188	cmd.exe
4792	cmd.exe
1576	cmd.exe
3412	cmd.exe
5036	cmd.exe
4924	cmd.exe
2568	cmd.exe
1224	cmd.exe
2404	cmd.exe
4856	cmd.exe
1112	cmd.exe
3012	cmd.exe
2044	cmd.exe
4488	cmd.exe
3484	cmd.exe
5600	cmd.exe
4780	cmd.exe
5464	cmd.exe
4600	cmd.exe
3832	cmd.exe
2788	cmd.exe
4304	cmd.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1100	1484	WerFault.exe	90

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Logo1_.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Logo1_.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Logo1_.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Logo1_.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3144	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
3144	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
3144	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
3144	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
3144	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
3144	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
3144	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
3144	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
3144	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
3144	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
3144	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
3144	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
3144	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
3144	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
3144	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
3144	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
3144	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
3144	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
1484	Logo1_.exe
1484	Logo1_.exe
1484	Logo1_.exe
1484	Logo1_.exe
1484	Logo1_.exe
1484	Logo1_.exe
1484	Logo1_.exe
1484	Logo1_.exe
1484	Logo1_.exe
1484	Logo1_.exe
1484	Logo1_.exe
1484	Logo1_.exe
1484	Logo1_.exe
1484	Logo1_.exe
1484	Logo1_.exe
1484	Logo1_.exe
1484	Logo1_.exe
1484	Logo1_.exe
1484	Logo1_.exe
1484	Logo1_.exe
1484	Logo1_.exe
1484	Logo1_.exe
1484	Logo1_.exe
1484	Logo1_.exe
1484	Logo1_.exe
1484	Logo1_.exe
1484	Logo1_.exe
1484	Logo1_.exe
1484	Logo1_.exe
1484	Logo1_.exe
1484	Logo1_.exe
1484	Logo1_.exe
1484	Logo1_.exe
1484	Logo1_.exe
1484	Logo1_.exe
1484	Logo1_.exe
1484	Logo1_.exe
1484	Logo1_.exe
1484	Logo1_.exe
1484	Logo1_.exe
1484	Logo1_.exe
1484	Logo1_.exe
1484	Logo1_.exe
1484	Logo1_.exe
3324	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
3324	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3144 wrote to memory of 3372	3144	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe	89
PID 3144 wrote to memory of 1484	3144	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe	90
PID 1484 wrote to memory of 5824	1484	Logo1_.exe	92
PID 5824 wrote to memory of 1764	5824	net.exe	94
PID 3372 wrote to memory of 600	3372	cmd.exe	95
PID 600 wrote to memory of 3836	600	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe	96
PID 3836 wrote to memory of 4796	3836	cmd.exe	98
PID 4796 wrote to memory of 4552	4796	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe	99
PID 4552 wrote to memory of 2444	4552	cmd.exe	101
PID 2444 wrote to memory of 2216	2444	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe	102
PID 2216 wrote to memory of 3252	2216	cmd.exe	104
PID 3252 wrote to memory of 5740	3252	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe	105
PID 5740 wrote to memory of 4352	5740	cmd.exe	107
PID 4352 wrote to memory of 2996	4352	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe	108
PID 2996 wrote to memory of 2628	2996	cmd.exe	112
PID 2628 wrote to memory of 4772	2628	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe	113
PID 4772 wrote to memory of 1176	4772	cmd.exe	116
PID 1176 wrote to memory of 5124	1176	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe	117
PID 5124 wrote to memory of 4112	5124	cmd.exe	119
PID 4112 wrote to memory of 5464	4112	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe	120
PID 5464 wrote to memory of 3324	5464	cmd.exe	122
PID 3324 wrote to memory of 5724	3324	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe	123
PID 3324 wrote to memory of 1144	3324	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe	124
PID 1144 wrote to memory of 4584	1144	Logo1_.exe	126
PID 4584 wrote to memory of 4696	4584	net.exe	128
PID 5724 wrote to memory of 4380	5724	cmd.exe	129
PID 4380 wrote to memory of 3756	4380	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe	130
PID 3756 wrote to memory of 5048	3756	cmd.exe	132
PID 5048 wrote to memory of 5964	5048	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe	133
PID 5964 wrote to memory of 1540	5964	cmd.exe	135
PID 1540 wrote to memory of 1836	1540	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe	136
PID 1836 wrote to memory of 5808	1836	cmd.exe	138
PID 5808 wrote to memory of 1056	5808	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe	139
PID 1056 wrote to memory of 5528	1056	cmd.exe	141
PID 5528 wrote to memory of 1188	5528	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe	142
PID 1188 wrote to memory of 5768	1188	cmd.exe	144
PID 5768 wrote to memory of 1112	5768	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe	145
PID 1112 wrote to memory of 4300	1112	cmd.exe	147
PID 4300 wrote to memory of 5792	4300	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe	148
PID 5792 wrote to memory of 5584	5792	cmd.exe	150
PID 5584 wrote to memory of 2016	5584	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe	151
PID 2016 wrote to memory of 5580	2016	cmd.exe	153
PID 5580 wrote to memory of 3012	5580	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe	154
PID 3012 wrote to memory of 4464	3012	cmd.exe	156
PID 4464 wrote to memory of 4600	4464	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe	157
PID 4600 wrote to memory of 5904	4600	cmd.exe	159
PID 5904 wrote to memory of 4568	5904	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe	160
PID 4568 wrote to memory of 4176	4568	cmd.exe	162
PID 4176 wrote to memory of 4924	4176	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe	163
PID 4924 wrote to memory of 4664	4924	cmd.exe	165
PID 4664 wrote to memory of 2568	4664	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe	166
PID 2568 wrote to memory of 1316	2568	cmd.exe	168
PID 1316 wrote to memory of 3360	1316	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe	169
PID 3360 wrote to memory of 5864	3360	cmd.exe	171
PID 5864 wrote to memory of 2964	5864	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe	172
PID 2964 wrote to memory of 3868	2964	cmd.exe	174
PID 3868 wrote to memory of 2304	3868	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe	175
PID 2304 wrote to memory of 5256	2304	cmd.exe	177
PID 5256 wrote to memory of 3960	5256	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe	178
PID 3960 wrote to memory of 4888	3960	cmd.exe	180
PID 4888 wrote to memory of 1224	4888	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe	181
PID 1224 wrote to memory of 3148	1224	cmd.exe	183
PID 3148 wrote to memory of 4332	3148	9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe	184
PID 4332 wrote to memory of 4160	4332	cmd.exe	186

C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
"C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3144
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5460.bat
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3372
- - C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
    "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:600
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a576D.bat
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3836
    - - C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
        
        "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of WriteProcessMemory
        
        PID:4796
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5980.bat
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4552
        
        C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
        
        "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
        7⤵
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of WriteProcessMemory
        
        PID:2444
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5C4F.bat
        8⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:2216
        
        C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
        
        "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
        9⤵
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of WriteProcessMemory
        
        PID:3252
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5DB6.bat
        10⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:5740
        
        C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
        
        "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
        11⤵
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of WriteProcessMemory
        
        PID:4352
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5FD9.bat
        12⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:2996
        
        C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
        
        "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
        13⤵
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of WriteProcessMemory
        
        PID:2628
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a61DD.bat
        14⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4772
        
        C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
        
        "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
        15⤵
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of WriteProcessMemory
        
        PID:1176
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6383.bat
        16⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5124
        
        C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
        
        "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
        17⤵
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of WriteProcessMemory
        
        PID:4112
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a65B5.bat
        18⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:5464
        
        C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
        
        "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
        19⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:3324
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6874.bat
        20⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5724
        
        C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
        
        "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
        21⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4380
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6AA7.bat
        22⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:3756
        
        C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
        
        "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
        23⤵
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of WriteProcessMemory
        
        PID:5048
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6CAA.bat
        24⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5964
        
        C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
        
        "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
        25⤵
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of WriteProcessMemory
        
        PID:1540
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6DF3.bat
        26⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:1836
        
        C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
        
        "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
        27⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5808
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7006.bat
        28⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:1056
        
        C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
        
        "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
        29⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5528
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a714E.bat
        30⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1188
        
        C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
        
        "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
        31⤵
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of WriteProcessMemory
        
        PID:5768
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a72D5.bat
        32⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1112
        
        C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
        
        "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
        33⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4300
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a743C.bat
        34⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:5792
        
        C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
        
        "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
        35⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5584
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a75F1.bat
        36⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2016
        
        C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
        
        "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
        37⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5580
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7797.bat
        38⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3012
        
        C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
        
        "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
        39⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4464
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a793D.bat
        40⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4600
        
        C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
        
        "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
        41⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5904
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7A18.bat
        42⤵
        Suspicious use of WriteProcessMemory
        
        PID:4568
        
        C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
        
        "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
        43⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4176
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7AE3.bat
        44⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4924
        
        C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
        
        "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
        45⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4664
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7B8F.bat
        46⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:2568
        
        C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
        
        "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
        47⤵
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of WriteProcessMemory
        
        PID:1316
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7C6A.bat
        48⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3360
        
        C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
        
        "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
        49⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5864
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7D35.bat
        50⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:2964
        
        C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
        
        "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
        51⤵
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of WriteProcessMemory
        
        PID:3868
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7DE1.bat
        52⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:2304
        
        C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
        
        "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
        53⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5256
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7EAC.bat
        54⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3960
        
        C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
        
        "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
        55⤵
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of WriteProcessMemory
        
        PID:4888
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7F77.bat
        56⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1224
        
        C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
        
        "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
        57⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3148
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8032.bat
        58⤵
        Suspicious use of WriteProcessMemory
        
        PID:4332
        
        C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
        
        "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
        59⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:4160
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a80DE.bat
        60⤵
        
        PID:4436
        
        C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
        
        "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
        61⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:4060
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a817B.bat
        62⤵
        Executes a command shell one-liner
        
        PID:2516
        
        C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
        
        "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
        63⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4256
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8246.bat
        64⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:6004
        
        C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
        
        "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
        65⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:2960
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a838E.bat
        66⤵
        Executes a command shell one-liner
        
        PID:3484
        
        C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
        
        "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
        67⤵
        Executes dropped EXE
        
        PID:2932
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a841A.bat
        68⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:3832
        
        C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
        
        "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
        69⤵
        Executes dropped EXE
        
        PID:5512
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a84F5.bat
        70⤵
        Executes a command shell one-liner
        
        PID:4108
        
        C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
        
        "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
        71⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:2132
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8582.bat
        72⤵
        Executes a command shell one-liner
        
        PID:3392
        
        C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
        
        "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
        73⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:5736
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a860E.bat
        74⤵
        Executes a command shell one-liner
        
        PID:624
        
        C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
        
        "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
        75⤵
        Executes dropped EXE
        
        PID:3272
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a86CA.bat
        76⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:2212
        
        C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
        
        "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
        77⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:5932
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8766.bat
        78⤵
        
        PID:4564
        
        C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
        
        "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
        79⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1428
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8812.bat
        80⤵
        Executes a command shell one-liner
        
        PID:4792
        
        C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
        
        "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
        81⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:5848
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a88AE.bat
        82⤵
        Executes a command shell one-liner
        
        PID:5600
        
        C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
        
        "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
        83⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4616
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a893B.bat
        84⤵
        Executes a command shell one-liner
        
        PID:4708
        
        C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
        
        "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
        85⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:6112
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a89C8.bat
        86⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:4080
        
        C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
        
        "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
        87⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5156
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8A73.bat
        88⤵
        Executes a command shell one-liner
        
        PID:5640
        
        C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
        
        "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
        89⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1660
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8B1F.bat
        90⤵
        Executes a command shell one-liner
        
        PID:4820
        
        C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
        
        "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
        91⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:5360
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8BAC.bat
        92⤵
        
        PID:5884
        
        C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
        
        "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
        93⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4156
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8C39.bat
        94⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:1376
        
        C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
        
        "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
        95⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2948
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8CC5.bat
        96⤵
        
        PID:2292
        
        C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
        
        "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
        97⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3428
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8D52.bat
        98⤵
        Executes a command shell one-liner
        
        PID:2164
        
        C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
        
        "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
        99⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:5344
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8DFE.bat
        100⤵
        Executes a command shell one-liner
        
        PID:1576
        
        C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
        
        "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
        101⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:5556
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8EC9.bat
        102⤵
        Executes a command shell one-liner
        
        PID:5200
        
        C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
        
        "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
        103⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5112
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8F84.bat
        104⤵
        Executes a command shell one-liner
        
        PID:4488
        
        C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
        
        "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
        105⤵
        Executes dropped EXE
        
        PID:2264
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a904F.bat
        106⤵
        
        PID:5920
        
        C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
        
        "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
        107⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5836
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a90FB.bat
        108⤵
        Executes a command shell one-liner
        
        PID:5444
        
        C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
        
        "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
        109⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:1252
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9198.bat
        110⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:2404
        
        C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
        
        "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
        111⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:1320
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9224.bat
        112⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:4388
        
        C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
        
        "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
        113⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:5940
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a92B1.bat
        114⤵
        Executes a command shell one-liner
        
        PID:3376
        
        C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
        
        "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
        115⤵
        Executes dropped EXE
        
        PID:2908
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a933D.bat
        116⤵
        System Location Discovery: System Language Discovery
        
        PID:2640
        
        C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
        
        "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
        117⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4604
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a93CA.bat
        118⤵
        Executes a command shell one-liner
        
        PID:4856
        
        C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
        
        "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
        119⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:716
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9457.bat
        120⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:2736
        
        C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
        
        "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
        121⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:4900
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a94F3.bat
        122⤵
        System Location Discovery: System Language Discovery
        
        PID:2256
        
        C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
        
        "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
        123⤵
        Executes dropped EXE
        
        PID:3216
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a959F.bat
        124⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:4636
        
        C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
        
        "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
        125⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:4672
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a963B.bat
        126⤵
        Executes a command shell one-liner
        
        PID:3444
        
        C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
        
        "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
        127⤵
        Drops file in Windows directory
        
        PID:3188
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a96C8.bat
        128⤵
        System Location Discovery: System Language Discovery
        
        PID:3436
        
        C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
        
        "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
        129⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:5300
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9774.bat
        130⤵
        Executes a command shell one-liner
        
        PID:1856
        
        C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
        
        "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
        131⤵
        Drops file in Windows directory
        
        PID:4480
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9800.bat
        132⤵
        System Location Discovery: System Language Discovery
        
        PID:1604
        
        C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
        
        "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
        133⤵
        Drops file in Windows directory
        
        PID:5712
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a988D.bat
        134⤵
        
        PID:1528
        
        C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
        
        "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
        135⤵
        Drops file in Windows directory
        
        PID:5412
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9929.bat
        136⤵
        
        PID:928
        
        C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
        
        "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
        137⤵
        Drops file in Windows directory
        
        PID:1688
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a99B6.bat
        138⤵
        Executes a command shell one-liner
        
        PID:2044
        
        C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
        
        "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
        139⤵
        System Location Discovery: System Language Discovery
        
        PID:2688
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9A42.bat
        140⤵
        Executes a command shell one-liner
        
        PID:4992
        
        C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
        
        "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
        141⤵
        Drops file in Windows directory
        
        PID:3424
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9ADF.bat
        142⤵
        Executes a command shell one-liner
        
        PID:3412
        
        C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
        
        "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
        143⤵
        Drops file in Windows directory
        
        PID:2228
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9B6B.bat
        144⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:4696
        
        C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
        
        "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
        145⤵
        Drops file in Windows directory
        
        PID:4288
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9BF8.bat
        146⤵
        System Location Discovery: System Language Discovery
        
        PID:4164
        
        C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
        
        "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
        147⤵
        
        PID:2872
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9C75.bat
        148⤵
        Executes a command shell one-liner
        
        PID:2364
        
        C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
        
        "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
        149⤵
        
        PID:3688
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9D01.bat
        150⤵
        Executes a command shell one-liner
        
        PID:2052
        
        C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
        
        "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
        151⤵
        Drops file in Windows directory
        
        PID:2504
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9D7E.bat
        152⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:3860
        
        C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
        
        "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
        153⤵
        
        PID:3136
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9E1B.bat
        154⤵
        
        PID:5236
        
        C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
        
        "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
        155⤵
        Drops file in Windows directory
        
        PID:4908
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9EB7.bat
        156⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:2788
        
        C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
        
        "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
        157⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:5780
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9F63.bat
        158⤵
        Executes a command shell one-liner
        
        PID:5024
        
        C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
        
        "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
        159⤵
        System Location Discovery: System Language Discovery
        
        PID:4548
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9FEF.bat
        160⤵
        Executes a command shell one-liner
        
        PID:1276
        
        C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
        
        "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
        161⤵
        
        PID:4180
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA08C.bat
        162⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:4780
        
        C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
        
        "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
        163⤵
        System Location Discovery: System Language Discovery
        
        PID:5420
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA118.bat
        164⤵
        Executes a command shell one-liner
        
        PID:5036
        
        C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
        
        "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
        165⤵
        Drops file in Windows directory
        
        PID:2620
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA1D4.bat
        166⤵
        Executes a command shell one-liner
        
        PID:4304
        
        C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
        
        "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
        167⤵
        Drops file in Windows directory
        
        PID:5020
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA280.bat
        168⤵
        Executes a command shell one-liner
        
        PID:3520
        
        C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe
        
        "C:\Users\Admin\AppData\Local\Temp\9ceae93ce5f834e654655e2aa0c80ed9fc87713c39d3e062aca115983df16e58.exe"
        169⤵
        
        PID:1904
        
        C:\Windows\Logo1_.exe
        
        C:\Windows\Logo1_.exe
        20⤵
        Executes dropped EXE
        Enumerates connected drives
        Drops file in Windows directory
        Reads the TCP/IP host and domain name from the registry
        Suspicious use of WriteProcessMemory
        
        PID:1144
        
        C:\Windows\SysWOW64\net.exe
        
        net stop "Kingsoft AntiVirus Service"
        21⤵
        Suspicious use of WriteProcessMemory
        
        PID:4584
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
        22⤵
        
        PID:4696
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Windows directory
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1484
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5824
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      PID:1764
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1484 -s 1012
    3⤵
    - Program crash
    PID:1100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1484 -ip 1484
1⤵
PID:3884

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

$$a5460.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a5460.bat
Size 722B
SHA256 c047780851a25ec33f5448af57621e3dce19a333bf03c876c60015e519bdcf87
MD5 29c804419596dff0b56afe1a3c245d4d
SHA1 7f075f86e70061698de06e756bcc6bb384d48b68
SHA512 36c5b4b74a28cfd1b201538fba5884e88240f71bcdacce02dec0c0030b9d2a4e6b4477baf3fded2d781b555bfbbc8240d83ccf326ff610d69b2bea2a222466aa
TLSH
T13301B11591C66FB544F8916B0C77BE9CC6AD0CD67B6C27600550CCAE1AC10FE69FF291
MD5 SHA1 SHA512 TLSH

Submit Download

$$a576D.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a576D.bat
Size 722B
SHA256 2f35abb65d9309146fde968db467a8deeb7821650b922762d0334dab80f6bd4c
MD5 45a1e1cec5515950fcd6dfaf0e917ceb
SHA1 cda7fc6cd6c17d32e09ac423aaef640d59423274
SHA512 07788af8e854aba2af914d7a11984c79fb2991c4b6fb38079843d69e43ba75404cf4c0c1630e7f78a172f3daf32bf4ad05acc06cbb10c927b4a54ac4667de1d5
TLSH
T15A01F11591C66FB444F8916B0D77BE9CC6AC0CD67B6C27600540CCAE1AC10FE69FF291
MD5 SHA1 SHA512 TLSH

Submit Download

$$a5980.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a5980.bat
Size 722B
SHA256 b2ab403f26df6bff9b623f4228ebac88d438f3172fccbe8ecca5b925dba84dc8
MD5 b894ab9493acae5da8a8d4349f6b2bcf
SHA1 74ded9010d57d594e2b966ff6968a04d0f262fbd
SHA512 2c1b60f6d90140e91736312d5705c22d7298cd8f0fa6b0f7757f6103e5577862a9b605d68903ab20b63396c00bdc37a6e1d56f8632d4c03b357b631abf3e934f
TLSH
T1F401DE2591866FF444F8916B0C66BE98C6AC0CD67B6C26600540C8AE2AC10FE69FF291
MD5 SHA1 SHA512 TLSH

Submit Download

$$a5C4F.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a5C4F.bat
Size 722B
SHA256 ef93e6960bb7c50305ce7b9c35e4eb543ab1347129b819e2dc3a400c2c8d8a61
MD5 803434b3e3db64fe525a59ff48342105
SHA1 3df920d7bf7993d8ce1d8aecbb85505edb622c5b
SHA512 db3284c214045a01eef0de577fcc7489a5e8c3df211dba6d9b5568be54996551ff4fd26f512b0712062c3e6365244a4f1bad1557298f4aac833c40c585026284
TLSH
T19101F11591C66FB444F8916B0C77BE9CC6AC0CD67B6C27600540CCAE1AC10FE69FF291
MD5 SHA1 SHA512 TLSH

Submit Download

$$a5DB6.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a5DB6.bat
Size 722B
SHA256 f70888a1d7f893d6074e49e7314e81c6db6bceefd196df148e4ede521cb52742
MD5 d6ed3e7de80961d74fbef2aece18a0be
SHA1 5515f3f3deffb34e2904b13e5d6bdadb5d75faea
SHA512 5afccf5ad650d1fa5192ddc9efcce648b01d90dca7564db48739763e293e9797682bdfcadc5887ed6347a86b8bd9f7f8b09682715706d05a0d1f9c589a31ce22
TLSH
T17C01F11591C66FB484F8916B0C77BE9CC6AC0CD67B6C27600540CCAE1AC10FE69FF291
MD5 SHA1 SHA512 TLSH

Submit Download

$$a5FD9.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a5FD9.bat
Size 722B
SHA256 5957d6f8c7a10e01572c98d9afc4ad24de55602f9a3ff24470df7a310f506b2e
MD5 b82a40d0ff2f6b501bbb4643c6699d10
SHA1 d50b68d2f1b0c3e271279c14199f3ec67d3ba7c8
SHA512 4d0c174ee687672ad6d0a758ab3248b973dffa1e6cb2247e785c424e77dff9660cb79012f28bcace65e1e2feb3d2f04de5aafe2e2ceec143db92611cc3a02cb1
TLSH
T1F101F11591C66FB444F8916B0C77BE9CC6AC0CD67B6C27600540CCAE1AC10FE69FF291
MD5 SHA1 SHA512 TLSH

Submit Download

$$a61DD.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a61DD.bat
Size 722B
SHA256 f3a08b2ae13c53b0c4a02de2a38eff727b02dff46bf73ab5e38d4b13326b7a3b
MD5 f217a7288e22f7e49e086101e0e26cfb
SHA1 d02e0f44dce630fee7f828ce66a0ef88f634dc05
SHA512 4b978d920a14486426ec2b39b7e1892b1613917d20dcf2d32dc1507974690f1132a2ebb241906fab8776a30f194d92322f243d84cf2a9ba3498d9ad8883ced39
TLSH
T18E01B11591C66FB544F8916B0C77BE9CC6AD0CD67B6C27600550CCAE1AC10FE69FF291
MD5 SHA1 SHA512 TLSH

Submit Download

$$a6383.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a6383.bat
Size 722B
SHA256 66eb081958b9f610ce2494f7b9716deb987688c21a32b02bb9992c3593946bbc
MD5 b5906923c1ee160886a828fbec25f9eb
SHA1 6a99b0298521e5acfdc99dc7862bb7d40290706b
SHA512 c8c04b5f70830d8ba301631fd172e0c604204e93bd9eeb31cfc624b3fa0a91411309db41c914626f281f41271ad6f6941871e4b6a2980956185d1c436f2e1bd6
TLSH
T18E01B11591C66FB544F8916B0C77BE9CC6AD0CD67B6C27600550CCAE1AC10FE69FF291
MD5 SHA1 SHA512 TLSH

Submit Download

$$a65B5.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a65B5.bat
Size 722B
SHA256 1e9711347efc19195b2a4b7aec20418d9962ef55740ed7b9a5ae07c6a1b7c4cf
MD5 e74446d9e1d84bd8ecf186e4f4bb0bce
SHA1 fd47c9c37b245f31c117a02ab33ef43f1c808570
SHA512 42fa16dfda3865c4dd79bdaf7227da8affd5e5c4b8032b3c1b9cfcacfa9243d0c992a0f8f248af37ed85abd04fb63ea0c004089d67ba939c8d8157e425a3d815
TLSH
T13C01F11591C66FB444F8916B0C77BE9CC6AC0CD67B6C27600540CCAE1AC10FE69FF291
MD5 SHA1 SHA512 TLSH

Submit Download

$$a6874.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a6874.bat
Size 722B
SHA256 352db315f6852334d86f0c9c1229fb1feb44f890aaebf4f19ed808df0956676d
MD5 6c99ca1db3c569ad866e14e0fd6eeb8b
SHA1 b7a71eb454fe1195b76fdb2509458cce6b7f2ccb
SHA512 5d7dba771520a0c0261d77291e7c8d4c32e107873f3183407d8b53e7599c4e4ed405b54276d48ecef0a139d97be8526124527458e3e9c68d71621d1aa7560618
TLSH
T15B01B11591C66FB544F8916B0C77BE9CC6AD0CD67B6C27600550CCAE2AC10FE69FF291
MD5 SHA1 SHA512 TLSH

Submit Download

$$a6AA7.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a6AA7.bat
Size 722B
SHA256 f2ac4d6b40416ef4be68d806f263746ceda1a52d4085416f61873e9aeb5847ba
MD5 b8d2903a42e2bcdff3a8caf1e37df472
SHA1 690d5113939956a02eff4024a20d87708098e4f3
SHA512 5bb3e3cfb2e6d1fb8507ba07d91114ddb6f9da4dcded2b7c6ab9edb94b325c30ea8d387071e4ef25529f82cb062358e589a70d9661158a1ad0cf312709a1576c
TLSH
T10301F11591C66FB444F8916B0C77BE9CC6AC0CD67B6C27601540CCAE1AC10FE69FF291
MD5 SHA1 SHA512 TLSH

Submit Download

$$a6CAA.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a6CAA.bat
Size 722B
SHA256 49669ff1a8d019bef86314c3caa98183cb4110b6e998c5c537580a8447b529ad
MD5 77772b112be9811e328b64c77ccab869
SHA1 7bdd25cfa1678a519161ccdb3853770cf057e7ec
SHA512 eb7e636762febd60e2bdf2acea04b21ccc22c75ad6a9603305e31cf7201bfbbd247e73da55b7dcc9521350931784efbaa18fe7408fdbd72d6d6476a5120fcfcb
TLSH
T17D01B11591C66FB544F8916B0C77BE9CC6AD0CD67B6C27600550CCAE1AC10FE69FF291
MD5 SHA1 SHA512 TLSH

Submit Download

$$a6DF3.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a6DF3.bat
Size 722B
SHA256 f0022031b78c657591725261155b9a613fc949db279f94130d0744d222397086
MD5 30a780334ede3b0006f137d044112ede
SHA1 1e8259c8c0d5f4010ac6abf2104dbb050dacad56
SHA512 6e532ac82af1c09257e02c821999fbc6d087d1e6669aa4a1c73aaeff006e02866b5f24fa618e838812bbd7a1814ec242903aa5d359761817e9298d7ebd575752
TLSH
T16C01B11591C66FB584F8916B0C77BE9CC6AD0CD67B6C27600550CCAE1AC10FE69FF291
MD5 SHA1 SHA512 TLSH

Submit Download

$$a7006.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a7006.bat
Size 722B
SHA256 bddf8c6b0b0f3d3f5dd49bd5ec7ce6c8a242473a899814c1272421ecc5ee6b75
MD5 90badb6f70be03c7224014ee45e70069
SHA1 47201a9f29078f40c343d4ee9c2767e6cc1132a3
SHA512 ea779ba03b509377f82634a158415298bba546d7cb85c4108ee07d7f0b1c35526483ff7d328ebcc063025a1a3d6d71e453b0764f32f298f6548a3363101a70e0
TLSH
T1B301F11591C66FB544F8916B0C77BE9CC6AC0CD67B6C27600540CCAE1AC10FE69FF291
MD5 SHA1 SHA512 TLSH

Submit Download

$$a714E.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a714E.bat
Size 722B
SHA256 439640859da4c6f79b271f678b53c63b445ae8586863d351b3e3cc5c38adcd01
MD5 e6b2ed3d05e5883dcb17b193f4627c72
SHA1 1d59b8abc56eacbc99b77a3290bda560fe148b8a
SHA512 23f8d162690f100d5f79f8ed198bb8fb4f132650fe2ed13d72c2360e0960ff6f3cfc9c4e29c74bb9def521634345d478a138c70a023f9eb764fbe02a40796a01
TLSH
T13B01F11591C66FB444F8916B0C77BE9CC6AC0CD67B6C27600550CCAE1AC10FE69FF291
MD5 SHA1 SHA512 TLSH

Submit Download

$$a72D5.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a72D5.bat
Size 722B
SHA256 97f3cac4880b28736f993214753dfcc38e1f5a01266485d0ffa285e5939be204
MD5 a3ac55cd3f7f6f3f9f7514b24a12ece3
SHA1 4f84ddc0ba3cc63e267cfe0c6e39d1a601fcc965
SHA512 968dfb1a2ce100a89203bb7bbcf50b8f2444882b3729bcd254d0a73b0c8b37b0994dc63cb8d93c029179b81cfd471fa33333ac7365376afb037cdad578519fae
TLSH
T16701F11591C66FB444F8916B0C77BE9CC6AC0CD67B6C27600540CCAE1AC10FE69FF291
MD5 SHA1 SHA512 TLSH

Submit Download

$$a743C.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a743C.bat
Size 722B
SHA256 6d0cd0b3350c0e635557990273a62faffbc0ea2916da5a4068fc51b6d4605d2a
MD5 ea3de24588e33ab764ccc8891eaa6204
SHA1 818816c43a8332243aa9dc0f2db7882732a3bdde
SHA512 961c0ca2acfedafd7e24c32c1da95d687fc7f2d150054f6ccd827537019cd6b5e8efa9643ec643e53ae23478e1fb77acb7a994394e18444911c7340a8e15c633
TLSH
T15A01B11591C66FB944F8916B0C77BE9CC6AD0CD67B6C27600550CCAE1AC10FE69FF291
MD5 SHA1 SHA512 TLSH

Submit Download

$$a75F1.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a75F1.bat
Size 722B
SHA256 105dbcf6c70c8e1e32a61210d9eab953b4f883814ff3ad0debd38deb04f0d690
MD5 5def87e9a9ce8a3f185a50a05a201593
SHA1 38432da8163acf9b994786e137dbf47522dd7752
SHA512 7ca64cba8734b7ea46c82a8e43674d9060a6bcf0e143d0e1eaa0d76a77cb4c5ebb6c0b85b54c79fbe832abddfb5bbfa4ef94af6a6c814e13f48367f6b770a9cf
TLSH
T10901B11591C66FB544F8916B0C77BE9CC6AD0CD67B6C27600550CCAE2AC10FE69FF291
MD5 SHA1 SHA512 TLSH

Submit Download