Overview

overview

7

Static

static

3

15e13b453a...fc.exe

windows10-2004-x64

7

15e13b453a...fc.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    127s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    02/10/2026, 07:00

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
  • Size 4.5MB
  • Sample261002-hs6efavaqe
  • SHA256 15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecution

Malware Config

Signatures

  • Executes dropped EXE 64 IoCs
  • Enumerates connected drives 3 TTPs 44 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Program crash 1 IoCs
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
    "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3348
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9E9.bat
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:944
      • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
        "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:2032
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE10.bat
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2384
          • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
            "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:1276
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a10CF.bat
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:4872
              • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                7⤵
                • Executes dropped EXE
                • Suspicious use of WriteProcessMemory
                PID:4304
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a143A.bat
                  8⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:5132
                  • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                    "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                    9⤵
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • Suspicious use of WriteProcessMemory
                    PID:3740
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a167C.bat
                      10⤵
                      • Executes a command shell one-liner
                      • Suspicious use of WriteProcessMemory
                      PID:5372
                      • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                        "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                        11⤵
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of WriteProcessMemory
                        PID:4800
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1989.bat
                          12⤵
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of WriteProcessMemory
                          PID:5872
                          • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                            "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                            13⤵
                            • Executes dropped EXE
                            • Suspicious use of WriteProcessMemory
                            PID:3736
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1C68.bat
                              14⤵
                              • Suspicious use of WriteProcessMemory
                              PID:4612
                              • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                15⤵
                                • Executes dropped EXE
                                • Drops file in Windows directory
                                • System Location Discovery: System Language Discovery
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of WriteProcessMemory
                                PID:3096
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1F46.bat
                                  16⤵
                                  • Executes a command shell one-liner
                                  • Suspicious use of WriteProcessMemory
                                  PID:2076
                                  • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                    "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • Suspicious use of WriteProcessMemory
                                    PID:2744
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2224.bat
                                      18⤵
                                      • Suspicious use of WriteProcessMemory
                                      PID:4896
                                      • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                        "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • Drops file in Windows directory
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious use of WriteProcessMemory
                                        PID:5424
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a24F3.bat
                                          20⤵
                                          • Executes a command shell one-liner
                                          • System Location Discovery: System Language Discovery
                                          • Suspicious use of WriteProcessMemory
                                          PID:3872
                                          • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                            "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • System Location Discovery: System Language Discovery
                                            • Suspicious use of WriteProcessMemory
                                            PID:1820
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a284E.bat
                                              22⤵
                                              • Suspicious use of WriteProcessMemory
                                              PID:3688
                                              • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • Drops file in Windows directory
                                                • Suspicious use of WriteProcessMemory
                                                PID:5672
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2A91.bat
                                                  24⤵
                                                  • Executes a command shell one-liner
                                                  • System Location Discovery: System Language Discovery
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:3352
                                                  • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:2840
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2D21.bat
                                                      26⤵
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:5964
                                                      • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:4992
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3128.bat
                                                          28⤵
                                                          • Executes a command shell one-liner
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:5772
                                                          • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:4272
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3270.bat
                                                              30⤵
                                                              • Executes a command shell one-liner
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:3848
                                                              • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:3128
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a34F1.bat
                                                                  32⤵
                                                                  • Executes a command shell one-liner
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:3112
                                                                  • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:5044
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a37A0.bat
                                                                      34⤵
                                                                      • System Location Discovery: System Language Discovery
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:4156
                                                                      • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Drops file in Windows directory
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:1744
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3A7F.bat
                                                                          36⤵
                                                                          • Executes a command shell one-liner
                                                                          • System Location Discovery: System Language Discovery
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:4644
                                                                          • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:2836
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3C63.bat
                                                                              38⤵
                                                                              • System Location Discovery: System Language Discovery
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:4704
                                                                              • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Drops file in Windows directory
                                                                                • System Location Discovery: System Language Discovery
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:940
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3F80.bat
                                                                                  40⤵
                                                                                  • Executes a command shell one-liner
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:3132
                                                                                  • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • Drops file in Windows directory
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:3368
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a408A.bat
                                                                                      42⤵
                                                                                      • Executes a command shell one-liner
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:4524
                                                                                      • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • Drops file in Windows directory
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:3408
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4184.bat
                                                                                          44⤵
                                                                                          • Executes a command shell one-liner
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:3400
                                                                                          • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:2500
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a42BC.bat
                                                                                              46⤵
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:5576
                                                                                              • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:2504
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a43C6.bat
                                                                                                  48⤵
                                                                                                  • Executes a command shell one-liner
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:4716
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Drops file in Windows directory
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:3304
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a44B0.bat
                                                                                                      50⤵
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:4924
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Drops file in Windows directory
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:3476
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a45BA.bat
                                                                                                          52⤵
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:5768
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:5384
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a46C3.bat
                                                                                                              54⤵
                                                                                                              • Executes a command shell one-liner
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:2432
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:2784
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a47EC.bat
                                                                                                                  56⤵
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:3932
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Drops file in Windows directory
                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:5608
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a48F6.bat
                                                                                                                      58⤵
                                                                                                                      • Executes a command shell one-liner
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:484
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Drops file in Windows directory
                                                                                                                        PID:4424
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a49FF.bat
                                                                                                                          60⤵
                                                                                                                            PID:5680
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                              61⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              • Drops file in Windows directory
                                                                                                                              PID:5484
                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4B48.bat
                                                                                                                                62⤵
                                                                                                                                  PID:4280
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                    63⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    • Drops file in Windows directory
                                                                                                                                    PID:5864
                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4C32.bat
                                                                                                                                      64⤵
                                                                                                                                        PID:3204
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                          65⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                          PID:2676
                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4D2C.bat
                                                                                                                                            66⤵
                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                            PID:2792
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                              67⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              PID:3432
                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4E36.bat
                                                                                                                                                68⤵
                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                PID:2896
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                  69⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  PID:3968
                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4F4F.bat
                                                                                                                                                    70⤵
                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                    PID:3708
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                      71⤵
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      PID:3412
                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5049.bat
                                                                                                                                                        72⤵
                                                                                                                                                          PID:1432
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                            73⤵
                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                            PID:2224
                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5162.bat
                                                                                                                                                              74⤵
                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                              PID:2180
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                75⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                PID:1620
                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a528B.bat
                                                                                                                                                                  76⤵
                                                                                                                                                                    PID:4264
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                      77⤵
                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                      PID:4208
                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5375.bat
                                                                                                                                                                        78⤵
                                                                                                                                                                          PID:5912
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                            79⤵
                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                            PID:2152
                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a548F.bat
                                                                                                                                                                              80⤵
                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                              PID:5376
                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                81⤵
                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                PID:1688
                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5589.bat
                                                                                                                                                                                  82⤵
                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                  PID:6048
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                    83⤵
                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                    PID:2108
                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5663.bat
                                                                                                                                                                                      84⤵
                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                      PID:2096
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                        85⤵
                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                        PID:3716
                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a572E.bat
                                                                                                                                                                                          86⤵
                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                          PID:4920
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                            87⤵
                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                            PID:2728
                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5809.bat
                                                                                                                                                                                              88⤵
                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                              PID:4116
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                89⤵
                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                PID:5524
                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5903.bat
                                                                                                                                                                                                  90⤵
                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                  PID:1340
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                    91⤵
                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                    PID:4892
                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5A1C.bat
                                                                                                                                                                                                      92⤵
                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                      PID:5536
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                        93⤵
                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                        PID:3920
                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5B26.bat
                                                                                                                                                                                                          94⤵
                                                                                                                                                                                                            PID:4784
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                              95⤵
                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                              PID:5988
                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5C5F.bat
                                                                                                                                                                                                                96⤵
                                                                                                                                                                                                                  PID:2884
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                    97⤵
                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                    PID:3068
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5D39.bat
                                                                                                                                                                                                                      98⤵
                                                                                                                                                                                                                        PID:2488
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                          99⤵
                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                          PID:3824
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5E24.bat
                                                                                                                                                                                                                            100⤵
                                                                                                                                                                                                                              PID:4640
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                101⤵
                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                PID:1088
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5F2D.bat
                                                                                                                                                                                                                                  102⤵
                                                                                                                                                                                                                                    PID:700
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                      103⤵
                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                      PID:4760
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5FF8.bat
                                                                                                                                                                                                                                        104⤵
                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                        PID:1684
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                          105⤵
                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                          PID:6140
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a60D3.bat
                                                                                                                                                                                                                                            106⤵
                                                                                                                                                                                                                                              PID:4880
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                107⤵
                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                PID:1936
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a61DD.bat
                                                                                                                                                                                                                                                  108⤵
                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                  PID:2452
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                    109⤵
                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                    PID:5560
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a62C7.bat
                                                                                                                                                                                                                                                      110⤵
                                                                                                                                                                                                                                                        PID:6072
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                          111⤵
                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                          PID:1152
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a63C1.bat
                                                                                                                                                                                                                                                            112⤵
                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                            PID:4484
                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                              113⤵
                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                              PID:696
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a64CB.bat
                                                                                                                                                                                                                                                                114⤵
                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                PID:936
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                                  115⤵
                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                  PID:1304
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a65A6.bat
                                                                                                                                                                                                                                                                    116⤵
                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                    PID:1612
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                                      117⤵
                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                      PID:2632
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6671.bat
                                                                                                                                                                                                                                                                        118⤵
                                                                                                                                                                                                                                                                          PID:756
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                                            119⤵
                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                            PID:1232
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a675B.bat
                                                                                                                                                                                                                                                                              120⤵
                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                              PID:4620
                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                                                121⤵
                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                PID:3596
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6836.bat
                                                                                                                                                                                                                                                                                  122⤵
                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                  PID:4776
                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                                                    123⤵
                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                    PID:3844
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6930.bat
                                                                                                                                                                                                                                                                                      124⤵
                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                      PID:1888
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                                                        125⤵
                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                        PID:6112
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6A49.bat
                                                                                                                                                                                                                                                                                          126⤵
                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                          PID:5108
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                                                            127⤵
                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                            PID:3548
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6B24.bat
                                                                                                                                                                                                                                                                                              128⤵
                                                                                                                                                                                                                                                                                                PID:4988
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                                                                  129⤵
                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                  PID:4684
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6C0E.bat
                                                                                                                                                                                                                                                                                                    130⤵
                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                    PID:5936
                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                                                                      131⤵
                                                                                                                                                                                                                                                                                                        PID:3240
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6CCA.bat
                                                                                                                                                                                                                                                                                                          132⤵
                                                                                                                                                                                                                                                                                                            PID:1804
                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                                                                              133⤵
                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                              PID:2968
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6DD3.bat
                                                                                                                                                                                                                                                                                                                134⤵
                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                PID:4308
                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                                                                                  135⤵
                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                  PID:5796
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6EAE.bat
                                                                                                                                                                                                                                                                                                                    136⤵
                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                    PID:3696
                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                                                                                      137⤵
                                                                                                                                                                                                                                                                                                                        PID:5844
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6FB8.bat
                                                                                                                                                                                                                                                                                                                          138⤵
                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                          PID:2156
                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                                                                                            139⤵
                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                            PID:480
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a70B2.bat
                                                                                                                                                                                                                                                                                                                              140⤵
                                                                                                                                                                                                                                                                                                                                PID:808
                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                                                                                                  141⤵
                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                  PID:5856
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a71BB.bat
                                                                                                                                                                                                                                                                                                                                    142⤵
                                                                                                                                                                                                                                                                                                                                      PID:4740
                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                                                                                                        143⤵
                                                                                                                                                                                                                                                                                                                                          PID:1536
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a72B5.bat
                                                                                                                                                                                                                                                                                                                                            144⤵
                                                                                                                                                                                                                                                                                                                                              PID:3804
                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                                                                                                                145⤵
                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                PID:3416
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a73AF.bat
                                                                                                                                                                                                                                                                                                                                                  146⤵
                                                                                                                                                                                                                                                                                                                                                    PID:3544
                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                                                                                                                      147⤵
                                                                                                                                                                                                                                                                                                                                                        PID:5064
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a748A.bat
                                                                                                                                                                                                                                                                                                                                                          148⤵
                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                          PID:5016
                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                                                                                                                            149⤵
                                                                                                                                                                                                                                                                                                                                                              PID:3724
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7574.bat
                                                                                                                                                                                                                                                                                                                                                                150⤵
                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                PID:5048
                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                                                                                                                                  151⤵
                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                  PID:5572
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7640.bat
                                                                                                                                                                                                                                                                                                                                                                    152⤵
                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                    PID:3324
                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                                                                                                                                      153⤵
                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                      PID:1552
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a772A.bat
                                                                                                                                                                                                                                                                                                                                                                        154⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:3632
                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                                                                                                                                            155⤵
                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                            PID:2692
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a77F5.bat
                                                                                                                                                                                                                                                                                                                                                                              156⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:4572
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                                                                                                                                                  157⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                  PID:1128
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a78D0.bat
                                                                                                                                                                                                                                                                                                                                                                                    158⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                    PID:3024
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                                                                                                                                                      159⤵
                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                      PID:3176
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a79BA.bat
                                                                                                                                                                                                                                                                                                                                                                                        160⤵
                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                        PID:3516
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                                                                                                                                                          161⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                          PID:4212
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7AB4.bat
                                                                                                                                                                                                                                                                                                                                                                                            162⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:4452
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                163⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:5744
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7B7F.bat
                                                                                                                                                                                                                                                                                                                                                                                                    164⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                    PID:3316
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                      165⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                      PID:3200
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7C79.bat
                                                                                                                                                                                                                                                                                                                                                                                                        166⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                        PID:3540
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                          167⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                          PID:2796
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7D83.bat
                                                                                                                                                                                                                                                                                                                                                                                                            168⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                            PID:2204
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                              169⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                              PID:2820
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7E6D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                170⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5932
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                    171⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2612
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7F48.bat
                                                                                                                                                                                                                                                                                                                                                                                                                        172⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4876
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                            173⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4756
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8061.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                174⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4964
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                  175⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4392
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a814C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    176⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2100
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                        177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4164
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8207.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                          178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3876
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                              179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6116
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8301.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4712
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                  181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5240
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a83DC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                    182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5676
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                        183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1192
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a84C6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                          184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4352
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                              185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4780
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a85A1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1184
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1420
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a866C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5952
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4416
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8757.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2712
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3372
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a88ED.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2960
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4232
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a89B8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2628
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1068
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8A83.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          196⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4688
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              197⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3136
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8B2F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                198⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2092
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  199⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3148
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8BDB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    200⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5528
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      201⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2144
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8C77.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        202⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5116
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          203⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1296
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8D33.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            204⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4948
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              205⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3184
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8DEE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                206⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6132
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  207⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1680
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8E9A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      208⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5996
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          209⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2320
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8F84.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            210⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2748
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                211⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4396
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9040.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  212⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1404
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    213⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5160
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a90EC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        214⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4180
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          215⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5692
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a91B7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              216⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4268
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  217⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2700
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9243.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      218⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4692
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          219⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4300
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a92E0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              220⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4404
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  221⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a93AB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    222⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3396
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      223⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2904
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9466.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          224⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4864
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            225⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2440
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9522.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                226⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2344
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  227⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3244
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a95ED.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    228⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2392
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        229⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5452
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9699.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          230⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2776
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            231⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3492
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9745.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              232⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4564
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                233⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2912
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9800.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  234⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4112
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    235⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1084
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a989C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      236⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2720
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        237⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:712
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9958.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          238⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3972
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              239⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6084
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9A04.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  240⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5948
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    241⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2348
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9AB0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        242⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2408
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            243⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6032
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9B5C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              244⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4724
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  245⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9C17.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    246⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4080
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        247⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:704
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9CC3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            248⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1600
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                249⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5736
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9D8E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    250⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4324
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      251⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1976
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9E4A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          252⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2184
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            253⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4384
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9F05.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              254⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2740
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                255⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4200
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9FE0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  256⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4544
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    257⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:628
                                                                                                                                                                  • C:\Windows\Logo1_.exe
                                                                                                                                                                    C:\Windows\Logo1_.exe
                                                                                                                                                                    16⤵
                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                    • Enumerates connected drives
                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                    • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                                                                    PID:2872
                                                                                                                                                                    • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                      net stop "Kingsoft AntiVirus Service"
                                                                                                                                                                      17⤵
                                                                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                                                                      PID:5968
                                                                                                                                                                      • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                                                        18⤵
                                                                                                                                                                          PID:484
                                                                                                                                        • C:\Windows\Logo1_.exe
                                                                                                                                          C:\Windows\Logo1_.exe
                                                                                                                                          2⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          • Enumerates connected drives
                                                                                                                                          • Reads the TCP/IP host and domain name from the registry
                                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                                          PID:4672
                                                                                                                                          • C:\Windows\SysWOW64\net.exe
                                                                                                                                            net stop "Kingsoft AntiVirus Service"
                                                                                                                                            3⤵
                                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                                            PID:4516
                                                                                                                                            • C:\Windows\SysWOW64\net1.exe
                                                                                                                                              C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                              4⤵
                                                                                                                                                PID:3548
                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 4672 -s 972
                                                                                                                                              3⤵
                                                                                                                                              • Program crash
                                                                                                                                              PID:2612
                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 392 -p 4672 -ip 4672
                                                                                                                                          1⤵
                                                                                                                                            PID:1636

                                                                                                                                          Network

                                                                                                                                                MITRE ATT&CK Enterprise v16

                                                                                                                                                Replay Monitor

                                                                                                                                                Loading Replay Monitor...

                                                                                                                                                Downloads

                                                                                                                                                $$a10CF.bat
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a10CF.bat
                                                                                                                                                • Size 722B
                                                                                                                                                • SHA256 8d441fe2db802eadda848a856f989c0bf17b502885cc65430d479dcced8b2b18
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                $$a143A.bat
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a143A.bat
                                                                                                                                                • Size 722B
                                                                                                                                                • SHA256 4981b18e9e3c708a8a7872addb39d6edc3095e1dc4cd13a9bbc96a7809b2456c
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                $$a167C.bat
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a167C.bat
                                                                                                                                                • Size 722B
                                                                                                                                                • SHA256 045b86582b119cebc55edb64b41dc8c7e3facc87bc799e20860edab4a6c45a1d
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                $$a1989.bat
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a1989.bat
                                                                                                                                                • Size 722B
                                                                                                                                                • SHA256 d6d7de5c6921e8916e15e7e65e827f1f87f4b4fee97e223a0e09db492fe6693e
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                $$a1C68.bat
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a1C68.bat
                                                                                                                                                • Size 722B
                                                                                                                                                • SHA256 a8e6aa2cfa2deb9666f64087b59d4d50a8293210aa59ee33b88164ee62f89ca3
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                $$a1F46.bat
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a1F46.bat
                                                                                                                                                • Size 722B
                                                                                                                                                • SHA256 e03271d057d3526031d84cc47ff4684cc23210792dbe698d4d6d45ca5377dec0
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                $$a2224.bat
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a2224.bat
                                                                                                                                                • Size 722B
                                                                                                                                                • SHA256 7e52003ba524021001702ee47c8ad45619039698884ddef32162a5de41c2049f
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                $$a24F3.bat
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a24F3.bat
                                                                                                                                                • Size 722B
                                                                                                                                                • SHA256 616b8ee8f76e7e81c4122fbcae94c53fb0e343aea4204a7fe9c2a44b9f972a6f
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                $$a284E.bat
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a284E.bat
                                                                                                                                                • Size 722B
                                                                                                                                                • SHA256 fcdfa30664d191c57040df6a5d254ab4cbdbae1a007be2ae28f3d55f19cb8e76
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                $$a2A91.bat
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a2A91.bat
                                                                                                                                                • Size 722B
                                                                                                                                                • SHA256 db33181908c8cb357f732d818a22d81c556961d6cc6e9a3418ffda97638d6aab
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                $$a2D21.bat
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a2D21.bat
                                                                                                                                                • Size 722B
                                                                                                                                                • SHA256 707697270ada716fa03cbbabe60903cdf511361ffda40c83be7075fdf1a350e1
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                $$a3128.bat
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a3128.bat
                                                                                                                                                • Size 722B
                                                                                                                                                • SHA256 7bc039dc738c1fd353a1ea3c3892f1ea3a59af66711a147a8f8628513d2f4e9d
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                $$a3270.bat
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a3270.bat
                                                                                                                                                • Size 722B
                                                                                                                                                • SHA256 c9da836094c981a5b49b9450cb23d4df8e2035f19d1667c154b50cab65e59a98
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                $$a34F1.bat
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a34F1.bat
                                                                                                                                                • Size 722B
                                                                                                                                                • SHA256 0681989650d261db827dc61349e9542e1afd8692e642123f0e45e29a00e1fe58
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                $$a37A0.bat
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a37A0.bat
                                                                                                                                                • Size 722B
                                                                                                                                                • SHA256 2dca5564e5d250cd0047df2026f95b9b83eff8fc0d27e9a6221cc116a6fe5d02
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                $$a3A7F.bat
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a3A7F.bat
                                                                                                                                                • Size 722B
                                                                                                                                                • SHA256 98e83f122608ea2c245942a2c24aece0eab25ddfbd4808c153e3e41ecffeb6c8
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                $$a9E9.bat
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a9E9.bat
                                                                                                                                                • Size 721B
                                                                                                                                                • SHA256 f17756b8bd80f3b14a7cd261543a0aab44c96248e3af9068058c858d63efd9d9
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                $$aE10.bat
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aE10.bat
                                                                                                                                                • Size 721B
                                                                                                                                                • SHA256 b4a4831d98492bd3c007ec35ef6da8e0459686d3a7e9084ffa74a971c190ab31
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe.exe
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe.exe
                                                                                                                                                • Size 4.3MB
                                                                                                                                                • SHA256 2929d799f4b1d5923447da669dadae0e648da316baf64278dd99eb6460f68dea
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe.exe
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe.exe
                                                                                                                                                • Size 4.5MB
                                                                                                                                                • SHA256 c5c7bede6e709463f61d5d6c8b5c9eaa15caf8d8c2bf72aa0bc808801c8b7d0e
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe.exe
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe.exe
                                                                                                                                                • Size 4.4MB
                                                                                                                                                • SHA256 578a69c56b8c151cd14735562b89776689cb8556be18604494433cfe44a82ccc
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe.exe
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe.exe
                                                                                                                                                • Size 4.4MB
                                                                                                                                                • SHA256 f736789652bfc017d6e87b07d2c7706c692f5dfb8b18810a4c3a10182390463c
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe.exe
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe.exe
                                                                                                                                                • Size 4.2MB
                                                                                                                                                • SHA256 b588f418928c093ce9965307f0e495d784e62db162d4aba89b1ee3ba3163f901
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe.exe
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe.exe
                                                                                                                                                • Size 4.4MB
                                                                                                                                                • SHA256 ea164f13e3ee86bd08a024c86e5d3f7c7bd28ef870cc66f49315dfd78686842a
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe.exe
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe.exe
                                                                                                                                                • Size 4.1MB
                                                                                                                                                • SHA256 936cbffee1bd002dc7d7ff0cc621683be9a6367d810156ae99641d465ed76170
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe.exe
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe.exe
                                                                                                                                                • Size 4.2MB
                                                                                                                                                • SHA256 9b82a0f80bae9203dcb466192e463e259904106c65578410de53cb176b53ea10
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe.exe
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe.exe
                                                                                                                                                • Size 4.3MB
                                                                                                                                                • SHA256 c760a908005d7de70539e8445c8bd6c461b34f3ffbeeafd5fe79d4fa0e843327
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe.exe
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe.exe
                                                                                                                                                • Size 4.0MB
                                                                                                                                                • SHA256 533863676a7638acc21b661dc3ccae7e59c56bf1ffc2e08ee66439696def1a46
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe.exe
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe.exe
                                                                                                                                                • Size 4.0MB
                                                                                                                                                • SHA256 5624990215bd33f63f8d9f118a07325bf10b5993ad01e3cff099ec9ee00bd8c5
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe.exe
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe.exe
                                                                                                                                                • Size 4.3MB
                                                                                                                                                • SHA256 440bbe978f25dbe3fd40e4ea3148f8302dee1ebf09edf355559cf76fec3c3adf
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe.exe
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe.exe
                                                                                                                                                • Size 4.2MB
                                                                                                                                                • SHA256 7bb4f2c2bf387140389e7de8c2287e7990b605a40075a4d39a08e426b3f38451
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe.exe
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe.exe
                                                                                                                                                • Size 4.2MB
                                                                                                                                                • SHA256 e01d6a680e8175e84b6c4749d68a29564364ba6285a2d9c3b94c25ba93ec41f0
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe.exe
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe.exe
                                                                                                                                                • Size 4.1MB
                                                                                                                                                • SHA256 b75d83c80a759cee08357551141ceefc5c8cbfd591381dbc8ec0eac88e928142
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe.exe
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe.exe
                                                                                                                                                • Size 4.1MB
                                                                                                                                                • SHA256 354b46bdf05a3ffe478b7ccbe228ba1499fac18c8b252c64e41cefe38749f218
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe.exe
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe.exe
                                                                                                                                                • Size 4.0MB
                                                                                                                                                • SHA256 55f6119a2008537e8b706d9e4a3320860953d4364a96325ea0f3cfc323abc2f1
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe.exe
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\15e13b453a0302dfbc3e4a06d89d0b1431f6b29b0d4768884556f73db658edfc.exe.exe
                                                                                                                                                • Size 3.9MB
                                                                                                                                                • SHA256 668e61e55273e0c4aee9745e03b296ae09675967c8f24f648a58576cdae39d4a
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                Dll.dll
                                                                                                                                                • Path C:\Windows\Dll.dll
                                                                                                                                                • Size 68KB
                                                                                                                                                • SHA256 58902ae17338af4211e7e21eddb09671507b48740fa7056b9b7f7ab307da0168
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                Logo1_.exe
                                                                                                                                                • Path C:\Windows\Logo1_.exe
                                                                                                                                                • Size 32KB
                                                                                                                                                • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                _desktop.ini
                                                                                                                                                • Path F:\$RECYCLE.BIN\_desktop.ini
                                                                                                                                                • Size 9B
                                                                                                                                                • SHA256 66c5371c302c0168792bdad2070b6db71275df5a2ac194c19d038c7fdde2b7d6
                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                Submit Download

                                                                                                                                                memory/480-515-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/696-430-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/704-894-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/712-859-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/940-207-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/1068-711-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/1084-852-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/1088-394-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/1128-578-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/1152-424-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/1192-669-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/1232-448-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/1276-35-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/1296-739-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/1304-436-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/1420-683-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/1536-529-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/1552-564-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/1620-316-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/1680-753-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/1688-334-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/1744-192-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/1820-127-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/1936-412-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/1976-908-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/2032-24-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/2108-340-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/2144-732-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/2152-328-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/2224-310-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/2320-760-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/2348-873-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/2440-817-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/2500-225-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/2504-231-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/2612-627-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/2632-442-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/2676-286-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/2692-571-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/2700-788-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/2728-352-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/2744-105-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/2784-256-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/2796-613-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/2820-620-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/2836-201-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/2840-145-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/2872-245-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/2872-187-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/2904-809-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/2912-845-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/2968-494-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/3068-382-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/3096-94-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/3128-172-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/3136-718-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/3148-725-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/3176-585-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/3184-746-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/3200-606-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/3240-486-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/3244-824-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/3304-237-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/3348-0-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/3348-13-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/3368-213-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/3372-697-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/3408-219-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/3412-304-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/3416-536-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/3432-292-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/3476-243-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/3492-838-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/3512-887-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/3548-472-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/3596-454-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/3716-346-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/3724-550-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/3736-78-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/3740-60-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/3824-388-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/3844-460-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/3920-370-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/3968-298-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/4164-648-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/4200-923-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/4200-917-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/4208-322-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/4212-592-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/4232-704-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/4272-163-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/4300-795-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/4304-51-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/4384-915-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/4392-641-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/4396-767-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/4416-690-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/4424-268-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/4512-802-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/4672-10-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/4672-82-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/4684-479-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/4756-634-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/4760-400-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/4780-676-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/4800-69-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/4892-364-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/4992-154-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/5044-182-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/5064-543-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/5160-774-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/5240-662-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/5384-250-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/5424-116-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/5452-831-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/5484-274-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/5524-358-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/5560-418-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/5572-557-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/5608-262-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/5672-136-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/5692-781-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/5736-901-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/5744-599-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/5796-501-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/5844-508-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/5856-522-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/5864-280-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/5988-376-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/6032-880-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/6084-866-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/6112-466-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/6116-655-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/6140-406-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                Download