Overview

overview

7

Static

static

3

15e13b453a...fc.exe

windows10-2004-x64

7

15e13b453a...fc.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    130s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    02/10/2026, 07:00

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
  • Size 4.5MB
  • Sample261002-hs6efavaqe
  • SHA256 15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecutionpersistenceprivilege_escalationspywarestealer

Malware Config

Signatures

  • Creates a file in the Startup directory 1 TTPs 2 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Executes dropped EXE 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 22 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 62 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
    "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
    1⤵
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4608
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a329F.bat
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:4424
      • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
        "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:884
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3464.bat
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4712
          • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
            "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:984
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3781.bat
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:1876
              • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                7⤵
                • Executes dropped EXE
                • Suspicious use of WriteProcessMemory
                PID:1132
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3A9E.bat
                  8⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:2468
                  • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                    "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                    9⤵
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • Suspicious use of WriteProcessMemory
                    PID:4544
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3D3E.bat
                      10⤵
                      • Executes a command shell one-liner
                      • Suspicious use of WriteProcessMemory
                      PID:1644
                      • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                        "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                        11⤵
                        • Executes dropped EXE
                        • Drops file in Windows directory
                        • Suspicious use of WriteProcessMemory
                        PID:4472
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3FFD.bat
                          12⤵
                          • Suspicious use of WriteProcessMemory
                          PID:2784
                          • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                            "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                            13⤵
                            • Executes dropped EXE
                            • System Location Discovery: System Language Discovery
                            • Suspicious use of WriteProcessMemory
                            PID:3704
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a42AC.bat
                              14⤵
                              • Suspicious use of WriteProcessMemory
                              PID:1872
                              • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                15⤵
                                • Executes dropped EXE
                                • Suspicious use of WriteProcessMemory
                                PID:2880
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a44DF.bat
                                  16⤵
                                  • Suspicious use of WriteProcessMemory
                                  PID:1028
                                  • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                    "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • Drops file in Windows directory
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious use of WriteProcessMemory
                                    PID:2416
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a478E.bat
                                      18⤵
                                      • Executes a command shell one-liner
                                      • Suspicious use of WriteProcessMemory
                                      PID:2364
                                      • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                        "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • Drops file in Windows directory
                                        • Suspicious use of WriteProcessMemory
                                        PID:2452
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4A7C.bat
                                          20⤵
                                          • Executes a command shell one-liner
                                          • Suspicious use of WriteProcessMemory
                                          PID:4048
                                          • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                            "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • Drops file in Windows directory
                                            • Suspicious use of WriteProcessMemory
                                            PID:1276
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a525C.bat
                                              22⤵
                                              • Executes a command shell one-liner
                                              • Suspicious use of WriteProcessMemory
                                              PID:4288
                                              • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • Drops file in Windows directory
                                                • Suspicious use of WriteProcessMemory
                                                PID:676
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a53E3.bat
                                                  24⤵
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:4692
                                                  • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Drops file in Windows directory
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:3692
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a58F4.bat
                                                      26⤵
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:4404
                                                      • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:5012
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a599F.bat
                                                          28⤵
                                                          • Executes a command shell one-liner
                                                          • System Location Discovery: System Language Discovery
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:5056
                                                          • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Drops file in Windows directory
                                                            • System Location Discovery: System Language Discovery
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:4520
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5D0A.bat
                                                              30⤵
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:2644
                                                              • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:116
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5FD9.bat
                                                                  32⤵
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:1592
                                                                  • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:4860
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6807.bat
                                                                      34⤵
                                                                      • Executes a command shell one-liner
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:4728
                                                                      • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Drops file in Windows directory
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:1808
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a696E.bat
                                                                          36⤵
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:3768
                                                                          • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • Drops file in Windows directory
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:1176
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6BC0.bat
                                                                              38⤵
                                                                              • Executes a command shell one-liner
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:224
                                                                              • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • System Location Discovery: System Language Discovery
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:4312
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6EBE.bat
                                                                                  40⤵
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:4992
                                                                                  • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • Drops file in Windows directory
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:2136
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7371.bat
                                                                                      42⤵
                                                                                      • Executes a command shell one-liner
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:1712
                                                                                      • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:4956
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7853.bat
                                                                                          44⤵
                                                                                          • Executes a command shell one-liner
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:2560
                                                                                          • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • Drops file in Windows directory
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:4180
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7B41.bat
                                                                                              46⤵
                                                                                              • Executes a command shell one-liner
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:4900
                                                                                              • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • Drops file in Windows directory
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:4656
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7BED.bat
                                                                                                  48⤵
                                                                                                  • Executes a command shell one-liner
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:4212
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:400
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7C89.bat
                                                                                                      50⤵
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:840
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Drops file in Windows directory
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:228
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7E00.bat
                                                                                                          52⤵
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:4148
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:2424
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7E7D.bat
                                                                                                              54⤵
                                                                                                              • Executes a command shell one-liner
                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:1728
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Drops file in Windows directory
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:4772
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7F0A.bat
                                                                                                                  56⤵
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:4216
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:2884
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7F96.bat
                                                                                                                      58⤵
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:3560
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                        PID:548
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8052.bat
                                                                                                                          60⤵
                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                          PID:632
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                            61⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                            PID:1256
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a80EE.bat
                                                                                                                              62⤵
                                                                                                                              • Executes a command shell one-liner
                                                                                                                              PID:4184
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                63⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                • Drops file in Windows directory
                                                                                                                                PID:2524
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a81B9.bat
                                                                                                                                  64⤵
                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                  PID:4880
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                    65⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    PID:1000
                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8236.bat
                                                                                                                                      66⤵
                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                      PID:2104
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                        67⤵
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        PID:3044
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8294.bat
                                                                                                                                          68⤵
                                                                                                                                            PID:2580
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                              69⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              PID:1180
                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8301.bat
                                                                                                                                                70⤵
                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                PID:4244
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                  71⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                  PID:3520
                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a838E.bat
                                                                                                                                                    72⤵
                                                                                                                                                      PID:4972
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                        73⤵
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                        PID:360
                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a84C6.bat
                                                                                                                                                          74⤵
                                                                                                                                                            PID:1680
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                              75⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                              PID:4924
                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a861E.bat
                                                                                                                                                                76⤵
                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                PID:4952
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                  77⤵
                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                  PID:2264
                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a86CA.bat
                                                                                                                                                                    78⤵
                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                    PID:2936
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                      79⤵
                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                      PID:2632
                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8737.bat
                                                                                                                                                                        80⤵
                                                                                                                                                                          PID:4476
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                            81⤵
                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                            PID:4716
                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8812.bat
                                                                                                                                                                              82⤵
                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                              PID:3204
                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                83⤵
                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                PID:4276
                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a888F.bat
                                                                                                                                                                                  84⤵
                                                                                                                                                                                    PID:2496
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                      85⤵
                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                      PID:2148
                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a89D7.bat
                                                                                                                                                                                        86⤵
                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                        PID:3472
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                          87⤵
                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                          PID:2124
                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8AA2.bat
                                                                                                                                                                                            88⤵
                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                            PID:3384
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                              89⤵
                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                              PID:616
                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8B6D.bat
                                                                                                                                                                                                90⤵
                                                                                                                                                                                                  PID:4832
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                    91⤵
                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                    PID:5892
                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9205.bat
                                                                                                                                                                                                      92⤵
                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                      PID:2668
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                        93⤵
                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                        PID:5372
                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a92D0.bat
                                                                                                                                                                                                          94⤵
                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                          PID:5520
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                            95⤵
                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                            PID:7020
                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a93AB.bat
                                                                                                                                                                                                              96⤵
                                                                                                                                                                                                                PID:6992
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                  97⤵
                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                  PID:5952
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9476.bat
                                                                                                                                                                                                                    98⤵
                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                    PID:6048
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                      99⤵
                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                      PID:5180
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9531.bat
                                                                                                                                                                                                                        100⤵
                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                        PID:5304
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                          101⤵
                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                          PID:6516
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a961C.bat
                                                                                                                                                                                                                            102⤵
                                                                                                                                                                                                                              PID:6632
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                103⤵
                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                PID:6068
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9716.bat
                                                                                                                                                                                                                                  104⤵
                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                  PID:5088
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                    105⤵
                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                    PID:6872
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a982F.bat
                                                                                                                                                                                                                                      106⤵
                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                      PID:4528
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                        107⤵
                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                        PID:3400
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9977.bat
                                                                                                                                                                                                                                          108⤵
                                                                                                                                                                                                                                            PID:5132
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                              109⤵
                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                              PID:5420
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9B3C.bat
                                                                                                                                                                                                                                                110⤵
                                                                                                                                                                                                                                                  PID:5452
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                    111⤵
                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                    PID:5508
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9BE8.bat
                                                                                                                                                                                                                                                      112⤵
                                                                                                                                                                                                                                                        PID:5536
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                          113⤵
                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                          PID:5616
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9C46.bat
                                                                                                                                                                                                                                                            114⤵
                                                                                                                                                                                                                                                              PID:5644
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                                115⤵
                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                PID:6160
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9CB3.bat
                                                                                                                                                                                                                                                                  116⤵
                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                  PID:6184
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                                    117⤵
                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                    PID:6236
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9D21.bat
                                                                                                                                                                                                                                                                      118⤵
                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                      PID:1164
                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                                        119⤵
                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                        PID:6296
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9D9E.bat
                                                                                                                                                                                                                                                                          120⤵
                                                                                                                                                                                                                                                                            PID:6324
                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                                              121⤵
                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                              PID:6344
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9E2A.bat
                                                                                                                                                                                                                                                                                122⤵
                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                PID:6376
                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                                                  123⤵
                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                  PID:6140
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9E98.bat
                                                                                                                                                                                                                                                                                    124⤵
                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                    PID:6456
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                                                      125⤵
                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                      PID:6512
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9EF5.bat
                                                                                                                                                                                                                                                                                        126⤵
                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                        PID:6544
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                                                          127⤵
                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                          PID:6604
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9FA1.bat
                                                                                                                                                                                                                                                                                            128⤵
                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                            PID:6628
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                                                              129⤵
                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                              PID:6688
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA0BB.bat
                                                                                                                                                                                                                                                                                                130⤵
                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                PID:6724
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                                                                  131⤵
                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                  PID:6812
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA109.bat
                                                                                                                                                                                                                                                                                                    132⤵
                                                                                                                                                                                                                                                                                                      PID:6852
                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                                                                        133⤵
                                                                                                                                                                                                                                                                                                          PID:5368
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA157.bat
                                                                                                                                                                                                                                                                                                            134⤵
                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                            PID:6988
                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                                                                              135⤵
                                                                                                                                                                                                                                                                                                                PID:2732
                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA195.bat
                                                                                                                                                                                                                                                                                                                  136⤵
                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                  PID:3084
                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                                                                                    137⤵
                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                    PID:7024
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA1E3.bat
                                                                                                                                                                                                                                                                                                                      138⤵
                                                                                                                                                                                                                                                                                                                        PID:6936
                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                                                                                          139⤵
                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                          PID:5864
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA232.bat
                                                                                                                                                                                                                                                                                                                            140⤵
                                                                                                                                                                                                                                                                                                                              PID:5852
                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                                                                                                141⤵
                                                                                                                                                                                                                                                                                                                                  PID:5792
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA280.bat
                                                                                                                                                                                                                                                                                                                                    142⤵
                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                    PID:5772
                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                                                                                                      143⤵
                                                                                                                                                                                                                                                                                                                                        PID:5712
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA2DD.bat
                                                                                                                                                                                                                                                                                                                                          144⤵
                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                          PID:5700
                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                                                                                                            145⤵
                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                            PID:5572
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA32C.bat
                                                                                                                                                                                                                                                                                                                                              146⤵
                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                              PID:6816
                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                                                                                                                147⤵
                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                PID:5916
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA37A.bat
                                                                                                                                                                                                                                                                                                                                                  148⤵
                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                  PID:5984
                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                                                                                                                    149⤵
                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                    PID:6040
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA3C8.bat
                                                                                                                                                                                                                                                                                                                                                      150⤵
                                                                                                                                                                                                                                                                                                                                                        PID:6076
                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                                                                                                                          151⤵
                                                                                                                                                                                                                                                                                                                                                            PID:2456
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA416.bat
                                                                                                                                                                                                                                                                                                                                                              152⤵
                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                              PID:4324
                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                                                                                                                                153⤵
                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                PID:4188
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA493.bat
                                                                                                                                                                                                                                                                                                                                                                  154⤵
                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                  PID:2288
                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                                                                                                                                    155⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:3288
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA4F1.bat
                                                                                                                                                                                                                                                                                                                                                                        156⤵
                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                        PID:3976
                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                                                                                                                                          157⤵
                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                          PID:1076
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA52F.bat
                                                                                                                                                                                                                                                                                                                                                                            158⤵
                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                            PID:932
                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                                                                                                                                              159⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:3884
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA57D.bat
                                                                                                                                                                                                                                                                                                                                                                                  160⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:3820
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                                                                                                                                                      161⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:3544
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA5CB.bat
                                                                                                                                                                                                                                                                                                                                                                                          162⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:6896
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                                                                                                                                                              163⤵
                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                              PID:5272
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA629.bat
                                                                                                                                                                                                                                                                                                                                                                                                164⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                PID:232
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                  165⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:5020
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA677.bat
                                                                                                                                                                                                                                                                                                                                                                                                      166⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                      PID:712
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                        167⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                        PID:5468
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA704.bat
                                                                                                                                                                                                                                                                                                                                                                                                          168⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                          PID:5128
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                            169⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                            PID:5476
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA7B0.bat
                                                                                                                                                                                                                                                                                                                                                                                                              170⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                              PID:5636
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                171⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5596
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA83C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                    172⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6252
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                        173⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6240
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA8B9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                            174⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6204
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                              175⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1952
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAA11.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                176⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6168
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                    177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6108
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAACD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                        178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6096
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                          179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6536
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAB69.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                              180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6504
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                  181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6652
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAC05.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                    182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6592
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                      183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6708
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aACA1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                        184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:7112
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                            185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6900
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAD1E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                              186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:7088
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5836
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAD9B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6860
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:7116
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAE09.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:7084
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5832
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAF32.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:7056
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:7156
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB00C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5880
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5944
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB089.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      196⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5848
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          197⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6036
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB0F7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            198⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5956
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                199⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4128
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB164.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    200⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5696
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      201⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5968
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB210.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          202⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5992
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              203⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2600
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB2FA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                204⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:684
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    205⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4748
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB377.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      206⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5076
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        207⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5172
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB433.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          208⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3824
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              209⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4588
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB4C0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                210⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1936
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  211⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB51D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    212⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2372
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        213⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6684
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB5BA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            214⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1760
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                215⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1556
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB656.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  216⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5504
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    217⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5632
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB6E2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        218⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5484
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          219⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6172
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB75F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            220⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5620
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              221⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6216
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB80B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  222⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5648
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    223⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6348
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB888.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      224⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6220
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          225⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6428
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB925.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            226⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6356
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                227⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1080
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB992.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  228⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:804
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    229⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6568
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBA3E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        230⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6484
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          231⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2540
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBADA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            232⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6616
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              233⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6660
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBB96.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                234⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6892
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  235⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2108
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBC70.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    236⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6644
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      237⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6788
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBD2C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        238⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:7000
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            239⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6916
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBDB8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                240⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:7140
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  241⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:7164
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBE55.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      242⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6944
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        243⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5872
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBF01.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          244⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5912
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            245⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBF8D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                246⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5392
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    247⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5960
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC029.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        248⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5920
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            249⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6928
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC0A6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              250⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5816
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                251⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5692
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC133.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  252⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6020
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    253⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5904
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC1C0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      254⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1192
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        255⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4724
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC26C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            256⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2392
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                257⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3252
                                                                                                                                  • C:\Windows\Logo1_.exe
                                                                                                                                    C:\Windows\Logo1_.exe
                                                                                                                                    2⤵
                                                                                                                                    • Creates a file in the Startup directory
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    • Enumerates connected drives
                                                                                                                                    • Drops file in Program Files directory
                                                                                                                                    • Drops file in Windows directory
                                                                                                                                    • Reads the TCP/IP host and domain name from the registry
                                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                                    PID:1364
                                                                                                                                    • C:\Windows\SysWOW64\net.exe
                                                                                                                                      net stop "Kingsoft AntiVirus Service"
                                                                                                                                      3⤵
                                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                                      PID:2332
                                                                                                                                      • C:\Windows\SysWOW64\net1.exe
                                                                                                                                        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                        4⤵
                                                                                                                                          PID:228

                                                                                                                                  Network

                                                                                                                                        MITRE ATT&CK Enterprise v16

                                                                                                                                        Reconnaissance

                                                                                                                                        Resource Development

                                                                                                                                        Initial Access

                                                                                                                                        Execution

                                                                                                                                        Command and Scripting Interpreter

                                                                                                                                        1
                                                                                                                                        T1059

                                                                                                                                        Windows Command Shell

                                                                                                                                        1
                                                                                                                                        T1059.003

                                                                                                                                        Persistence

                                                                                                                                        Boot or Logon Autostart Execution

                                                                                                                                        1
                                                                                                                                        T1547

                                                                                                                                        Registry Run Keys / Startup Folder

                                                                                                                                        1
                                                                                                                                        T1547.001

                                                                                                                                        Privilege Escalation

                                                                                                                                        Boot or Logon Autostart Execution

                                                                                                                                        1
                                                                                                                                        T1547

                                                                                                                                        Registry Run Keys / Startup Folder

                                                                                                                                        1
                                                                                                                                        T1547.001

                                                                                                                                        Defense Evasion

                                                                                                                                        Credential Access

                                                                                                                                        Credentials from Password Stores

                                                                                                                                        1
                                                                                                                                        T1555

                                                                                                                                        Credentials from Web Browsers

                                                                                                                                        1
                                                                                                                                        T1555.003

                                                                                                                                        Unsecured Credentials

                                                                                                                                        1
                                                                                                                                        T1552

                                                                                                                                        Credentials In Files

                                                                                                                                        1
                                                                                                                                        T1552.001

                                                                                                                                        Discovery

                                                                                                                                        Peripheral Device Discovery

                                                                                                                                        1
                                                                                                                                        T1120

                                                                                                                                        Query Registry

                                                                                                                                        1
                                                                                                                                        T1012

                                                                                                                                        System Information Discovery

                                                                                                                                        1
                                                                                                                                        T1082

                                                                                                                                        System Location Discovery

                                                                                                                                        1
                                                                                                                                        T1614

                                                                                                                                        System Language Discovery

                                                                                                                                        1
                                                                                                                                        T1614.001

                                                                                                                                        System Network Configuration Discovery

                                                                                                                                        1
                                                                                                                                        T1016

                                                                                                                                        Lateral Movement

                                                                                                                                        Collection

                                                                                                                                        Data from Local System

                                                                                                                                        1
                                                                                                                                        T1005

                                                                                                                                        Command and Control

                                                                                                                                        Exfiltration

                                                                                                                                        Impact

                                                                                                                                        Replay Monitor

                                                                                                                                        Loading Replay Monitor...

                                                                                                                                        Downloads

                                                                                                                                        $$a329F.bat
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a329F.bat
                                                                                                                                        • Size 722B
                                                                                                                                        • SHA256 25b68fa57b6a10c57a152be9ba9f0f3385e7d0219e6c1a64547b4fd931ac6156
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        $$a3464.bat
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a3464.bat
                                                                                                                                        • Size 722B
                                                                                                                                        • SHA256 e9f952dd05fe23f029794ca7e3c6c78e4f9f7c81d91ac1177d46397d5ceeb5c7
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        $$a3781.bat
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a3781.bat
                                                                                                                                        • Size 722B
                                                                                                                                        • SHA256 42e87fefe9ee005964201f3a398dbf952edc8c6953c3e33329d66a65546261de
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        $$a3A9E.bat
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a3A9E.bat
                                                                                                                                        • Size 722B
                                                                                                                                        • SHA256 c1ce86ae359c9f14077e6ba07111e998e326b185fb5c128178bcb1212865a50b
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        $$a3D3E.bat
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a3D3E.bat
                                                                                                                                        • Size 722B
                                                                                                                                        • SHA256 41bce5b2ed7ab484ae3d3e65518d1cb8467ec861e7a64439dae9074153bc1bb7
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        $$a3FFD.bat
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a3FFD.bat
                                                                                                                                        • Size 722B
                                                                                                                                        • SHA256 b55e5c5c177d2bd11422a4bb8b610361072b1a406bad83c4ee1685071ebb09b7
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        $$a42AC.bat
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a42AC.bat
                                                                                                                                        • Size 722B
                                                                                                                                        • SHA256 3cb5994d53894a35095ea1b2d2c70b12ed3aa3f92992a835214354e68c513629
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        $$a44DF.bat
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a44DF.bat
                                                                                                                                        • Size 722B
                                                                                                                                        • SHA256 242d34c588710792b1e7d76b752ac3fadae05e10855fb7b3de68617bf87cd345
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        $$a478E.bat
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a478E.bat
                                                                                                                                        • Size 722B
                                                                                                                                        • SHA256 975179a80b23e7ead17724a269f5eef167dfd0d96f08e067716691ba0c5d43a5
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        $$a4A7C.bat
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a4A7C.bat
                                                                                                                                        • Size 722B
                                                                                                                                        • SHA256 ebe2af62984d85993803991a7946d3894cdab387d229afbd47a03563f32449e9
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        $$a525C.bat
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a525C.bat
                                                                                                                                        • Size 722B
                                                                                                                                        • SHA256 5c67415164dc87efc027611192ea3f57be34f11ec7bec8e546f3b9512f04177b
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        $$a53E3.bat
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a53E3.bat
                                                                                                                                        • Size 722B
                                                                                                                                        • SHA256 b2ebcb27de93f24829f2642a2ab38d7cdec8e668c86c9610fd776c8102808b56
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        $$a58F4.bat
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a58F4.bat
                                                                                                                                        • Size 722B
                                                                                                                                        • SHA256 35d2fdca6212fe627c55c947b7b6491006641196ac27301dfe20ad9417064ad6
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        $$a599F.bat
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a599F.bat
                                                                                                                                        • Size 722B
                                                                                                                                        • SHA256 df6157fa026aa460ec7e34adfeb5621ed6573104afdf2380106800208e581a9e
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        $$a5D0A.bat
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a5D0A.bat
                                                                                                                                        • Size 722B
                                                                                                                                        • SHA256 db9c394cc3e40cf7dcaaf76a1aa058a3c9a977de17fd0a1c01886a0fd783612d
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        $$a5FD9.bat
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a5FD9.bat
                                                                                                                                        • Size 722B
                                                                                                                                        • SHA256 912a61f88a05adfafea0c8a1ab36f6a3c249fdc65f24c99fda2d9d5d88f2040a
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        $$a6807.bat
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a6807.bat
                                                                                                                                        • Size 722B
                                                                                                                                        • SHA256 32ce77a9e165f3e6cf19d14183a4e1a9bc5ef01090f43c6e0d69374ed52e4bc3
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        $$a696E.bat
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a696E.bat
                                                                                                                                        • Size 722B
                                                                                                                                        • SHA256 ec049bae5860ed73aca1d221f6e6b2770f9da627d8985fd6824c3a902c99eac6
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        $$a6BC0.bat
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a6BC0.bat
                                                                                                                                        • Size 722B
                                                                                                                                        • SHA256 b17556d508d06863687b962e48c4a7a67e54a2125a7e333b40bddeaae7344545
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        $$a6EBE.bat
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a6EBE.bat
                                                                                                                                        • Size 722B
                                                                                                                                        • SHA256 a8c81ede22593daa5253deb07df21bcceb5500271404891dfa459b0023876673
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        $$a7371.bat
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a7371.bat
                                                                                                                                        • Size 722B
                                                                                                                                        • SHA256 6e7969734cf4dc85aa67cb73d2236107376b1c4cf01f9526a1be0b8e673e0eee
                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                        Submit Download

                                                                                                                                        15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe.exe
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe.exe
                                                                                                                                        • Size 4.2MB
                                                                                                                                        • SHA256 e01d6a680e8175e84b6c4749d68a29564364ba6285a2d9c3b94c25ba93ec41f0
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe.exe
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe.exe
                                                                                                                                        • Size 4.2MB
                                                                                                                                        • SHA256 b588f418928c093ce9965307f0e495d784e62db162d4aba89b1ee3ba3163f901
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe.exe
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe.exe
                                                                                                                                        • Size 4.1MB
                                                                                                                                        • SHA256 b75d83c80a759cee08357551141ceefc5c8cbfd591381dbc8ec0eac88e928142
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe.exe
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe.exe
                                                                                                                                        • Size 4.0MB
                                                                                                                                        • SHA256 533863676a7638acc21b661dc3ccae7e59c56bf1ffc2e08ee66439696def1a46
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe.exe
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe.exe
                                                                                                                                        • Size 4.0MB
                                                                                                                                        • SHA256 5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe.exe
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe.exe
                                                                                                                                        • Size 3.9MB
                                                                                                                                        • SHA256 668e61e55273e0c4aee9745e03b296ae09675967c8f24f648a58576cdae39d4a
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe.exe
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe.exe
                                                                                                                                        • Size 3.9MB
                                                                                                                                        • SHA256 f53ab27df5dec3d1001b94507c960909a3ac7f1f5861eb3b74290061412b8066
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe.exe
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe.exe
                                                                                                                                        • Size 4.2MB
                                                                                                                                        • SHA256 7bb4f2c2bf387140389e7de8c2287e7990b605a40075a4d39a08e426b3f38451
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe.exe
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe.exe
                                                                                                                                        • Size 4.1MB
                                                                                                                                        • SHA256 936cbffee1bd002dc7d7ff0cc621683be9a6367d810156ae99641d465ed76170
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe.exe
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe.exe
                                                                                                                                        • Size 4.1MB
                                                                                                                                        • SHA256 354b46bdf05a3ffe478b7ccbe228ba1499fac18c8b252c64e41cefe38749f218
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe.exe
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe.exe
                                                                                                                                        • Size 3.9MB
                                                                                                                                        • SHA256 efc17f73d8f69153686f34b26f48d59bd413779477c1c0d399ca9c9250c90ea3
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe.exe
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe.exe
                                                                                                                                        • Size 4.5MB
                                                                                                                                        • SHA256 c5c7bede6e709463f61d5d6c8b5c9eaa15caf8d8c2bf72aa0bc808801c8b7d0e
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe.exe
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe.exe
                                                                                                                                        • Size 4.0MB
                                                                                                                                        • SHA256 55f6119a2008537e8b706d9e4a3320860953d4364a96325ea0f3cfc323abc2f1
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe.exe
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe.exe
                                                                                                                                        • Size 4.4MB
                                                                                                                                        • SHA256 ea164f13e3ee86bd08a024c86e5d3f7c7bd28ef870cc66f49315dfd78686842a
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe.exe
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe.exe
                                                                                                                                        • Size 4.3MB
                                                                                                                                        • SHA256 c760a908005d7de70539e8445c8bd6c461b34f3ffbeeafd5fe79d4fa0e843327
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe.exe
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe.exe
                                                                                                                                        • Size 4.3MB
                                                                                                                                        • SHA256 2929d799f4b1d5923447da669dadae0e648da316baf64278dd99eb6460f68dea
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe.exe
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe.exe
                                                                                                                                        • Size 4.2MB
                                                                                                                                        • SHA256 9b82a0f80bae9203dcb466192e463e259904106c65578410de53cb176b53ea10
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe.exe
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe.exe
                                                                                                                                        • Size 4.4MB
                                                                                                                                        • SHA256 578a69c56b8c151cd14735562b89776689cb8556be18604494433cfe44a82ccc
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe.exe
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe.exe
                                                                                                                                        • Size 4.4MB
                                                                                                                                        • SHA256 f736789652bfc017d6e87b07d2c7706c692f5dfb8b18810a4c3a10182390463c
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe.exe
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe.exe
                                                                                                                                        • Size 4.3MB
                                                                                                                                        • SHA256 440bbe978f25dbe3fd40e4ea3148f8302dee1ebf09edf355559cf76fec3c3adf
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        Logo1_.exe
                                                                                                                                        • Path C:\Windows\Logo1_.exe
                                                                                                                                        • Size 32KB
                                                                                                                                        • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                        Submit Download

                                                                                                                                        _desktop.ini
                                                                                                                                        • Path F:\$RECYCLE.BIN\_desktop.ini
                                                                                                                                        • Size 9B
                                                                                                                                        • SHA256 66c5371c302c0168792bdad2070b6db71275df5a2ac194c19d038c7fdde2b7d6
                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                        Submit Download

                                                                                                                                        memory/116-2234-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/228-5669-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/360-6228-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/400-5664-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/548-5946-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/616-6634-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/676-1763-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/884-21-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/984-31-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/1000-6208-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/1076-10351-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/1080-10562-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/1132-40-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/1176-3442-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/1180-6218-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/1256-6069-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/1276-1394-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/1364-6177-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/1364-810-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/1364-2120-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/1364-11-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/1556-10526-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/1808-3332-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/1884-10514-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/1952-10406-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/2108-10586-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/2124-6459-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/2136-4396-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/2148-6328-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/2264-6242-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/2416-92-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/2424-5674-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/2452-136-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/2456-10333-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/2524-6203-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/2540-10574-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/2600-10490-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/2632-6247-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/2732-10285-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/2880-84-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/2884-5790-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/3044-6213-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/3288-10345-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/3400-10210-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/3520-6223-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/3544-10363-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/3692-1881-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/3704-74-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/3884-10357-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/4128-10478-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/4180-5654-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/4188-10339-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/4276-6257-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/4312-3696-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/4472-66-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/4520-2124-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/4544-54-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/4588-10508-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/4608-10-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/4608-0-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/4656-5659-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/4716-6252-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/4724-10642-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/4724-10647-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/4748-10496-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/4772-5679-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/4860-3196-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/4924-6237-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/4956-5355-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/5012-1889-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/5020-10375-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/5172-10502-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/5180-9656-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/5272-10369-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/5340-10616-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/5368-10279-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/5372-9076-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/5420-10215-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/5468-10381-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/5476-10387-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/5508-10220-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/5572-10315-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/5596-10394-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/5616-10225-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/5632-10532-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/5692-10634-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/5712-10309-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/5792-10303-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/5832-10454-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/5836-10442-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/5864-10297-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/5872-10610-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/5892-8909-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/5904-10640-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/5916-10321-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/5944-10466-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/5952-9452-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/5960-10622-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/5968-10484-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/6036-10472-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/6040-10327-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/6068-10168-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/6108-10412-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/6140-10250-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/6160-10230-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/6172-10538-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/6216-10544-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/6236-10235-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/6240-10400-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/6296-10240-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/6344-10245-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/6348-10550-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/6428-10556-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/6512-10255-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/6516-9855-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/6536-10418-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/6568-10568-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/6604-10261-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/6652-10424-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/6660-10580-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/6684-10520-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/6688-10267-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/6708-10430-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/6788-10592-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/6812-10273-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/6872-10205-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/6900-10436-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/6916-10598-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/6928-10628-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/7020-9331-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/7024-10291-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/7116-10448-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/7156-10460-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/7164-10604-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                        Download