Overview

overview

7

Static

static

3

1515867ce0...3e.exe

windows10-2004-x64

7

1515867ce0...3e.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    127s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    11/10/2026, 11:35

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe
  • Size 4.6MB
  • Sample261011-np6tpazzaz
  • SHA256 1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecution

Malware Config

Signatures

  • Executes dropped EXE 64 IoCs
  • Enumerates connected drives 3 TTPs 42 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe
    "C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1132
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a525C.bat
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2456
      • C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe
        "C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:2580
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5598.bat
          4⤵
          • Executes a command shell one-liner
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4576
          • C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe
            "C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe"
            5⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            • Suspicious use of WriteProcessMemory
            PID:936
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a57EA.bat
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:4208
              • C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe
                "C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe"
                7⤵
                • Executes dropped EXE
                • Drops file in Windows directory
                • Suspicious use of WriteProcessMemory
                PID:1816
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5BB3.bat
                  8⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:3684
                  • C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe
                    "C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe"
                    9⤵
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • Suspicious use of WriteProcessMemory
                    PID:4280
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5DD6.bat
                      10⤵
                      • Suspicious use of WriteProcessMemory
                      PID:5344
                      • C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe
                        "C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe"
                        11⤵
                        • Executes dropped EXE
                        • Suspicious use of WriteProcessMemory
                        PID:5980
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6056.bat
                          12⤵
                          • Suspicious use of WriteProcessMemory
                          PID:5208
                          • C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe
                            "C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe"
                            13⤵
                            • Executes dropped EXE
                            • Suspicious use of WriteProcessMemory
                            PID:252
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a62B8.bat
                              14⤵
                              • System Location Discovery: System Language Discovery
                              • Suspicious use of WriteProcessMemory
                              PID:2256
                              • C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe
                                "C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe"
                                15⤵
                                • Executes dropped EXE
                                • Suspicious use of WriteProcessMemory
                                PID:4372
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6519.bat
                                  16⤵
                                  • Suspicious use of WriteProcessMemory
                                  PID:4188
                                  • C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe
                                    "C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • Suspicious use of WriteProcessMemory
                                    PID:2064
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a695F.bat
                                      18⤵
                                      • Executes a command shell one-liner
                                      • Suspicious use of WriteProcessMemory
                                      PID:4652
                                      • C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe
                                        "C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • Suspicious use of WriteProcessMemory
                                        PID:1892
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a717D.bat
                                          20⤵
                                          • Executes a command shell one-liner
                                          • Suspicious use of WriteProcessMemory
                                          PID:992
                                          • C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe
                                            "C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • Drops file in Windows directory
                                            • Suspicious use of WriteProcessMemory
                                            PID:2420
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a73DE.bat
                                              22⤵
                                              • Suspicious use of WriteProcessMemory
                                              PID:4248
                                              • C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe
                                                "C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • Drops file in Windows directory
                                                • Suspicious use of WriteProcessMemory
                                                PID:6932
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8265.bat
                                                  24⤵
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:7284
                                                  • C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Drops file in Windows directory
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:6368
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a87D4.bat
                                                      26⤵
                                                      • Executes a command shell one-liner
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:6476
                                                      • C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • System Location Discovery: System Language Discovery
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:7972
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8A45.bat
                                                          28⤵
                                                          • Executes a command shell one-liner
                                                          • System Location Discovery: System Language Discovery
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:6568
                                                          • C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Drops file in Windows directory
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:6816
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8D42.bat
                                                              30⤵
                                                              • System Location Discovery: System Language Discovery
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:6784
                                                              • C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Drops file in Windows directory
                                                                • System Location Discovery: System Language Discovery
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:6920
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8F65.bat
                                                                  32⤵
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:6976
                                                                  • C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:7112
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9188.bat
                                                                      34⤵
                                                                      • Executes a command shell one-liner
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:7144
                                                                      • C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Drops file in Windows directory
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:7196
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a93CA.bat
                                                                          36⤵
                                                                          • Executes a command shell one-liner
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:7232
                                                                          • C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • Drops file in Windows directory
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:7380
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a95FD.bat
                                                                              38⤵
                                                                              • Executes a command shell one-liner
                                                                              • System Location Discovery: System Language Discovery
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:7392
                                                                              • C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:7452
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9810.bat
                                                                                  40⤵
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:7492
                                                                                  • C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • Drops file in Windows directory
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:7560
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a98CB.bat
                                                                                      42⤵
                                                                                      • Executes a command shell one-liner
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:7584
                                                                                      • C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:7640
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9996.bat
                                                                                          44⤵
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:7676
                                                                                          • C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:7724
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9A81.bat
                                                                                              46⤵
                                                                                              • Executes a command shell one-liner
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:7760
                                                                                              • C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • Drops file in Windows directory
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:7308
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9B6B.bat
                                                                                                  48⤵
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:2308
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:7888
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9C36.bat
                                                                                                      50⤵
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:8020
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:5216
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9D01.bat
                                                                                                          52⤵
                                                                                                          • Executes a command shell one-liner
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:7948
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:8008
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9DAD.bat
                                                                                                              54⤵
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:6964
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Drops file in Windows directory
                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:8136
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9E69.bat
                                                                                                                  56⤵
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:4320
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Drops file in Windows directory
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:8176
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9F24.bat
                                                                                                                      58⤵
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:3564
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Drops file in Windows directory
                                                                                                                        PID:2316
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9FFF.bat
                                                                                                                          60⤵
                                                                                                                          • Executes a command shell one-liner
                                                                                                                          PID:1488
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe"
                                                                                                                            61⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            PID:4644
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA0DA.bat
                                                                                                                              62⤵
                                                                                                                                PID:6512
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe"
                                                                                                                                  63⤵
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  PID:6488
                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA195.bat
                                                                                                                                    64⤵
                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                    PID:1220
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe
                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe"
                                                                                                                                      65⤵
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      PID:4620
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA260.bat
                                                                                                                                        66⤵
                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                        PID:2876
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe
                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe"
                                                                                                                                          67⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          PID:6236
                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA32C.bat
                                                                                                                                            68⤵
                                                                                                                                              PID:4192
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe"
                                                                                                                                                69⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                PID:7032
                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA3F7.bat
                                                                                                                                                  70⤵
                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                  PID:4268
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe
                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe"
                                                                                                                                                    71⤵
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    PID:6220
                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA4A3.bat
                                                                                                                                                      72⤵
                                                                                                                                                        PID:6564
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe"
                                                                                                                                                          73⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                          PID:7040
                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA56E.bat
                                                                                                                                                            74⤵
                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                            PID:3496
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe"
                                                                                                                                                              75⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                              PID:2464
                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA668.bat
                                                                                                                                                                76⤵
                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                PID:5840
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe"
                                                                                                                                                                  77⤵
                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                  PID:5592
                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA723.bat
                                                                                                                                                                    78⤵
                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                    PID:1028
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe
                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe"
                                                                                                                                                                      79⤵
                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                      PID:4328
                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA7CF.bat
                                                                                                                                                                        80⤵
                                                                                                                                                                          PID:4064
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe
                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe"
                                                                                                                                                                            81⤵
                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                            PID:3220
                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA89A.bat
                                                                                                                                                                              82⤵
                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                              PID:1660
                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe
                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe"
                                                                                                                                                                                83⤵
                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                PID:5856
                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA965.bat
                                                                                                                                                                                  84⤵
                                                                                                                                                                                    PID:1460
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe
                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe"
                                                                                                                                                                                      85⤵
                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                      PID:3348
                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAA11.bat
                                                                                                                                                                                        86⤵
                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                        PID:2248
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe
                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe"
                                                                                                                                                                                          87⤵
                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                          PID:2568
                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAADC.bat
                                                                                                                                                                                            88⤵
                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                            PID:2188
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe
                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe"
                                                                                                                                                                                              89⤵
                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                              PID:1684
                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAB98.bat
                                                                                                                                                                                                90⤵
                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                PID:3816
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe
                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe"
                                                                                                                                                                                                  91⤵
                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                  PID:4104
                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAC44.bat
                                                                                                                                                                                                    92⤵
                                                                                                                                                                                                      PID:3712
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe
                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe"
                                                                                                                                                                                                        93⤵
                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                        PID:4900
                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aACFF.bat
                                                                                                                                                                                                          94⤵
                                                                                                                                                                                                            PID:4568
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe
                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe"
                                                                                                                                                                                                              95⤵
                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                              PID:5136
                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aADBB.bat
                                                                                                                                                                                                                96⤵
                                                                                                                                                                                                                  PID:6092
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe
                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe"
                                                                                                                                                                                                                    97⤵
                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                    PID:2756
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAE86.bat
                                                                                                                                                                                                                      98⤵
                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                      PID:5400
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe
                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe"
                                                                                                                                                                                                                        99⤵
                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                        PID:1400
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAF32.bat
                                                                                                                                                                                                                          100⤵
                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                          PID:4124
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe
                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe"
                                                                                                                                                                                                                            101⤵
                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                            PID:1496
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB00C.bat
                                                                                                                                                                                                                              102⤵
                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                              PID:3064
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe
                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe"
                                                                                                                                                                                                                                103⤵
                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                PID:2692
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB0D8.bat
                                                                                                                                                                                                                                  104⤵
                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                  PID:6196
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe
                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe"
                                                                                                                                                                                                                                    105⤵
                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                    PID:4820
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB193.bat
                                                                                                                                                                                                                                      106⤵
                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                      PID:4516
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe
                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe"
                                                                                                                                                                                                                                        107⤵
                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                        PID:6168
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB24F.bat
                                                                                                                                                                                                                                          108⤵
                                                                                                                                                                                                                                            PID:7796
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe
                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe"
                                                                                                                                                                                                                                              109⤵
                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                              PID:7876
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB339.bat
                                                                                                                                                                                                                                                110⤵
                                                                                                                                                                                                                                                  PID:7328
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe
                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe"
                                                                                                                                                                                                                                                    111⤵
                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                    PID:3028
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB404.bat
                                                                                                                                                                                                                                                      112⤵
                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                      PID:2148
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe
                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe"
                                                                                                                                                                                                                                                        113⤵
                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                        PID:3732
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB4C0.bat
                                                                                                                                                                                                                                                          114⤵
                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                          PID:6560
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe
                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe"
                                                                                                                                                                                                                                                            115⤵
                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                            PID:6444
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB57B.bat
                                                                                                                                                                                                                                                              116⤵
                                                                                                                                                                                                                                                                PID:8076
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe
                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe"
                                                                                                                                                                                                                                                                  117⤵
                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                  PID:6740
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB627.bat
                                                                                                                                                                                                                                                                    118⤵
                                                                                                                                                                                                                                                                      PID:6852
                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe
                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe"
                                                                                                                                                                                                                                                                        119⤵
                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                        PID:8180
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB6E2.bat
                                                                                                                                                                                                                                                                          120⤵
                                                                                                                                                                                                                                                                            PID:7080
                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe
                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe"
                                                                                                                                                                                                                                                                              121⤵
                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                              PID:7012
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB77F.bat
                                                                                                                                                                                                                                                                                122⤵
                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                PID:7256
                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe
                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe"
                                                                                                                                                                                                                                                                                  123⤵
                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                  PID:6992
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB82B.bat
                                                                                                                                                                                                                                                                                    124⤵
                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                    PID:7200
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe
                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe"
                                                                                                                                                                                                                                                                                      125⤵
                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                      PID:2176
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB8E6.bat
                                                                                                                                                                                                                                                                                        126⤵
                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                        PID:7372
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe
                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe"
                                                                                                                                                                                                                                                                                          127⤵
                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                          PID:6936
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB9C1.bat
                                                                                                                                                                                                                                                                                            128⤵
                                                                                                                                                                                                                                                                                              PID:7384
                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe
                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe"
                                                                                                                                                                                                                                                                                                129⤵
                                                                                                                                                                                                                                                                                                  PID:7424
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBA6D.bat
                                                                                                                                                                                                                                                                                                    130⤵
                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                    PID:7576
                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe
                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe"
                                                                                                                                                                                                                                                                                                      131⤵
                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                      PID:7636
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBB19.bat
                                                                                                                                                                                                                                                                                                        132⤵
                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                        PID:7652
                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe
                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe"
                                                                                                                                                                                                                                                                                                          133⤵
                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                          PID:7748
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBBE4.bat
                                                                                                                                                                                                                                                                                                            134⤵
                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                            PID:7700
                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe
                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe"
                                                                                                                                                                                                                                                                                                              135⤵
                                                                                                                                                                                                                                                                                                                PID:3696
                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBC90.bat
                                                                                                                                                                                                                                                                                                                  136⤵
                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                  PID:7756
                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe
                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe"
                                                                                                                                                                                                                                                                                                                    137⤵
                                                                                                                                                                                                                                                                                                                      PID:8032
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBD4B.bat
                                                                                                                                                                                                                                                                                                                        138⤵
                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                        PID:7896
                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe
                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe"
                                                                                                                                                                                                                                                                                                                          139⤵
                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                          PID:7968
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBDE7.bat
                                                                                                                                                                                                                                                                                                                            140⤵
                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                            PID:6968
                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe
                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe"
                                                                                                                                                                                                                                                                                                                              141⤵
                                                                                                                                                                                                                                                                                                                                PID:7996
                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBE93.bat
                                                                                                                                                                                                                                                                                                                                  142⤵
                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                  PID:7976
                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe
                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe"
                                                                                                                                                                                                                                                                                                                                    143⤵
                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                    PID:8056
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBF2F.bat
                                                                                                                                                                                                                                                                                                                                      144⤵
                                                                                                                                                                                                                                                                                                                                        PID:8188
                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe
                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe"
                                                                                                                                                                                                                                                                                                                                          145⤵
                                                                                                                                                                                                                                                                                                                                            PID:8168
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBFCC.bat
                                                                                                                                                                                                                                                                                                                                              146⤵
                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                              PID:3436
                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe
                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe"
                                                                                                                                                                                                                                                                                                                                                147⤵
                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                PID:1120
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC078.bat
                                                                                                                                                                                                                                                                                                                                                  148⤵
                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                  PID:6412
                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe
                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe"
                                                                                                                                                                                                                                                                                                                                                    149⤵
                                                                                                                                                                                                                                                                                                                                                      PID:6272
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC114.bat
                                                                                                                                                                                                                                                                                                                                                        150⤵
                                                                                                                                                                                                                                                                                                                                                          PID:3468
                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe"
                                                                                                                                                                                                                                                                                                                                                            151⤵
                                                                                                                                                                                                                                                                                                                                                              PID:6464
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC1DF.bat
                                                                                                                                                                                                                                                                                                                                                                152⤵
                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                PID:6456
                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe"
                                                                                                                                                                                                                                                                                                                                                                  153⤵
                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                  PID:6332
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC29A.bat
                                                                                                                                                                                                                                                                                                                                                                    154⤵
                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                    PID:3788
                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe
                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe"
                                                                                                                                                                                                                                                                                                                                                                      155⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:4136
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC385.bat
                                                                                                                                                                                                                                                                                                                                                                          156⤵
                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                          PID:6892
                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe
                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe"
                                                                                                                                                                                                                                                                                                                                                                            157⤵
                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                            PID:2284
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC431.bat
                                                                                                                                                                                                                                                                                                                                                                              158⤵
                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                              PID:6668
                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe
                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe"
                                                                                                                                                                                                                                                                                                                                                                                159⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:1388
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC4BD.bat
                                                                                                                                                                                                                                                                                                                                                                                    160⤵
                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                    PID:2212
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe
                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe"
                                                                                                                                                                                                                                                                                                                                                                                      161⤵
                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                      PID:996
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC598.bat
                                                                                                                                                                                                                                                                                                                                                                                        162⤵
                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                        PID:4432
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe
                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe"
                                                                                                                                                                                                                                                                                                                                                                                          163⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                          PID:1896
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC663.bat
                                                                                                                                                                                                                                                                                                                                                                                            164⤵
                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                            PID:5448
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe
                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe"
                                                                                                                                                                                                                                                                                                                                                                                              165⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:4232
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC6FF.bat
                                                                                                                                                                                                                                                                                                                                                                                                  166⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:4536
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe
                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                      167⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:3776
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC7BB.bat
                                                                                                                                                                                                                                                                                                                                                                                                          168⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                          PID:2808
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe
                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                            169⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:4824
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC848.bat
                                                                                                                                                                                                                                                                                                                                                                                                                170⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                PID:1740
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                  171⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1272
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC903.bat
                                                                                                                                                                                                                                                                                                                                                                                                                    172⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5988
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                      173⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:428
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC99F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                          174⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1760
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                            175⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5668
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCA4B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                176⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1112
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                    177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:472
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCB07.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                        178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4284
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                          179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5088
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCBB3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                              180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3544
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1992
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCC6E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                  182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4988
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                    183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2320
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCD1A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                        184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6256
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                          185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6160
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCDD5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                            186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5220
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:7804
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCE62.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6336
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6376
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCEEF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:7860
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2152
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCF8B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:7332
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5032
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD018.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:7964
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6448
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD0B4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            196⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6812
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              197⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6776
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD140.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                198⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6792
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    199⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:8044
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD20C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      200⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:7092
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          201⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:7076
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD289.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              202⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:7136
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                203⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5424
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD354.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  204⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:7224
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    205⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:7484
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD400.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      206⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:7512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        207⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:7468
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD4CB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            208⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:7604
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              209⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:7532
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD577.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                210⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:7732
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  211⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:7620
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD622.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    212⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5268
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      213⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:7672
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD6BF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        214⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3272
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          215⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:7908
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD78A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            216⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:7916
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              217⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6516
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD826.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  218⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:7104
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    219⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:8068
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD8D2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      220⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2644
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          221⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4984
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD98D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            222⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2972
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                223⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:7312
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDA39.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  224⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4420
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    225⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6280
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDAF5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      226⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        227⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3256
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDBA1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          228⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1960
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            229⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6860
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDC4D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              230⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6952
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                231⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:7028
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDCD9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    232⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2860
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      233⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5640
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDD75.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          234⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6912
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              235⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:7072
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDE21.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                236⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5852
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    237⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4496
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDEBE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        238⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4260
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            239⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4784
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDF3B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              240⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2620
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                241⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5440
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDFC7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    242⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2988
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        243⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4264
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE044.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          244⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:756
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              245⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4220
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE0E0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                246⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4668
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  247⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5636
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE16D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      248⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          249⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1228
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE209.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              250⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4160
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  251⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3016
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE2A6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      252⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4252
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        253⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3380
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE342.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          254⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5908
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            255⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1004
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE3BF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              256⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5968
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                257⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2404
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE43C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  258⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1852
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      259⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3444
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE4D8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        260⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:248
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            261⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6320
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE584.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                262⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4992
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    263⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1592
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE620.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        264⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6288
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          265⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4884
                                                                                                                                                                                                • C:\Windows\Logo1_.exe
                                                                                                                                                                                                  C:\Windows\Logo1_.exe
                                                                                                                                                                                                  28⤵
                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                  • Enumerates connected drives
                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                  • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                  PID:6544
                                                                                                                                                                                                  • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                    net stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                    29⤵
                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                    PID:6704
                                                                                                                                                                                                    • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                      30⤵
                                                                                                                                                                                                        PID:6760
                                                                                                                                              • C:\Windows\Logo1_.exe
                                                                                                                                                C:\Windows\Logo1_.exe
                                                                                                                                                2⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                • Enumerates connected drives
                                                                                                                                                • Drops file in Program Files directory
                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                                                PID:4336
                                                                                                                                                • C:\Windows\SysWOW64\net.exe
                                                                                                                                                  net stop "Kingsoft AntiVirus Service"
                                                                                                                                                  3⤵
                                                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                                                  PID:3076
                                                                                                                                                  • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                    C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                                    4⤵
                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                    PID:4768

                                                                                                                                            Network

                                                                                                                                                  MITRE ATT&CK Enterprise v16

                                                                                                                                                  Replay Monitor

                                                                                                                                                  Loading Replay Monitor...

                                                                                                                                                  Downloads

                                                                                                                                                  $$a525C.bat
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a525C.bat
                                                                                                                                                  • Size 722B
                                                                                                                                                  • SHA256 d94b8dc10a3bf172532edb0269c60f1202b9fdc047651b54f70ff768077d94c6
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  $$a5598.bat
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a5598.bat
                                                                                                                                                  • Size 722B
                                                                                                                                                  • SHA256 ad512e3c8c602df7df97aba10be658a4294dc72c7f681195da56d0b549bf51d1
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  $$a57EA.bat
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a57EA.bat
                                                                                                                                                  • Size 722B
                                                                                                                                                  • SHA256 f57062600a7fd86d6c7e144dd27e2e8726584689acbba2a90f00e116a31704fc
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  $$a5BB3.bat
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a5BB3.bat
                                                                                                                                                  • Size 722B
                                                                                                                                                  • SHA256 0df7a0c68a3db39453672a4a167a95d7333e1dc92be3c3cf7bcb9b65c82cba13
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  $$a5DD6.bat
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a5DD6.bat
                                                                                                                                                  • Size 722B
                                                                                                                                                  • SHA256 f50028f7c8cbbe0ad2722ff2e1d36f8d95657375db636210a3b25b6111a9303c
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  $$a6056.bat
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a6056.bat
                                                                                                                                                  • Size 722B
                                                                                                                                                  • SHA256 978afd65f6c00929460806188f0036d5622e65db68fa271566fa6fb160b0c653
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  $$a62B8.bat
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a62B8.bat
                                                                                                                                                  • Size 722B
                                                                                                                                                  • SHA256 1ce8d5743053555dde7c53b9c8e8069af1c61468884e04967447daef6a4b8707
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  $$a6519.bat
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a6519.bat
                                                                                                                                                  • Size 722B
                                                                                                                                                  • SHA256 78e10d52d526742a1d4f0064bb8f7d067c081fb92966eae4dcff1010e30345dc
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  $$a695F.bat
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a695F.bat
                                                                                                                                                  • Size 722B
                                                                                                                                                  • SHA256 4d181ebe5c256b45aea9954061e1ea8782ccfd6a76d7945961e264e39cacbd45
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  $$a717D.bat
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a717D.bat
                                                                                                                                                  • Size 722B
                                                                                                                                                  • SHA256 abbf60ba79007554e7fc6d8e05e47ae98ccad6598ae1511f005160407a0f2ab4
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  $$a73DE.bat
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a73DE.bat
                                                                                                                                                  • Size 722B
                                                                                                                                                  • SHA256 8c23d394039ebfe9ac1a20a6bef09361d59abc19a05b47ba5e102a2b2b125653
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  $$a8265.bat
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a8265.bat
                                                                                                                                                  • Size 722B
                                                                                                                                                  • SHA256 60b5f803e358732294c9dcf9ad3f39d5b50922038986e17810085b9b3d3f2d5e
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  $$a87D4.bat
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a87D4.bat
                                                                                                                                                  • Size 722B
                                                                                                                                                  • SHA256 42501a668146f1b5fa29e3c58e830bbba61a92e8df512bb0dcaee834c7fbc00a
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  $$a8A45.bat
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a8A45.bat
                                                                                                                                                  • Size 722B
                                                                                                                                                  • SHA256 b4d5aea47f34e33f47728ddf39dfbd09092af9e147c23ebde72ceed1c90ca61c
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  $$a8D42.bat
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a8D42.bat
                                                                                                                                                  • Size 722B
                                                                                                                                                  • SHA256 74b7a786f05fc6f3840dcbdb92f9f6f5c9143087c231b28d6ad976a7bc855c1f
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  $$a8F65.bat
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a8F65.bat
                                                                                                                                                  • Size 722B
                                                                                                                                                  • SHA256 8e1169cd702bafd7d8c218f08b321feb94dc3cb0b6ab18a9e3437b695873c91a
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  $$a9188.bat
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a9188.bat
                                                                                                                                                  • Size 722B
                                                                                                                                                  • SHA256 05bdd1ef6720a9463296012c399fe9fc0946bd5cae4c983ed2de810bd073cb6e
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  $$a93CA.bat
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a93CA.bat
                                                                                                                                                  • Size 722B
                                                                                                                                                  • SHA256 61319a4b355904e27325ed031f7749a41c4e62980b795a76fcf5879cd2cf3d0f
                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe.exe
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe.exe
                                                                                                                                                  • Size 4.5MB
                                                                                                                                                  • SHA256 9a9e696e15d904cfe05847bdaf30a87c9429f9d247c8ce0c7c5cf835e1b5208c
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe.exe
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe.exe
                                                                                                                                                  • Size 4.4MB
                                                                                                                                                  • SHA256 55f2f860fe730f58e4e372c4045d09481b87c6cf8da86fd3984bc4a5be5c2876
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe.exe
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe.exe
                                                                                                                                                  • Size 4.6MB
                                                                                                                                                  • SHA256 e024ce764e4bed4e943dcd9127832a8268eaaba7d58da9ebb5e44b39d818b4c4
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe.exe
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe.exe
                                                                                                                                                  • Size 4.4MB
                                                                                                                                                  • SHA256 e61c4a15f05fe99f584b11fe84579206376b37957daf2feecebb57fe94ff5f07
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe.exe
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe.exe
                                                                                                                                                  • Size 4.3MB
                                                                                                                                                  • SHA256 2d5f2fe107b2c5c13488644321c26efc3c310785435f8f4ab9d875157c3bd22f
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe.exe
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe.exe
                                                                                                                                                  • Size 4.2MB
                                                                                                                                                  • SHA256 fb4bf691ffbbbf6b9b14d30db1a44bb51664b3fde8a6e1ce03fed05f5fa1bd98
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe.exe
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe.exe
                                                                                                                                                  • Size 4.2MB
                                                                                                                                                  • SHA256 a9fcacd1bc768630c9cfc8a5679caa64a03f28f0dab74fbf26cdbe721e6d5e77
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe.exe
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe.exe
                                                                                                                                                  • Size 4.2MB
                                                                                                                                                  • SHA256 26da1b419b3438b0fadbf05686455b3c678d568c47c948a502db6989df967884
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe.exe
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe.exe
                                                                                                                                                  • Size 4.2MB
                                                                                                                                                  • SHA256 5a61d19aa721745c9956181bc919f618e529ad9231bf2d83b0f9d97b52319870
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe.exe
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe.exe
                                                                                                                                                  • Size 4.6MB
                                                                                                                                                  • SHA256 7566256b4f5cdf367b880bda6b4019fa3bccb91bcd1bfb7416206a34b5554e8c
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe.exe
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe.exe
                                                                                                                                                  • Size 4.1MB
                                                                                                                                                  • SHA256 a08eef9c02753c09ed816c4b86d4e35d8d6ebc3b385ca14b3b574e256167b1d8
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe.exe
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe.exe
                                                                                                                                                  • Size 4.1MB
                                                                                                                                                  • SHA256 daa6b674821fd408c88e59843747c2b2e3d78260cfc034ede1118913112a5b5a
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe.exe
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe.exe
                                                                                                                                                  • Size 4.5MB
                                                                                                                                                  • SHA256 3d9d99f22485ff91193ead277733f4c39067978c832985149913666a6e876b09
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe.exe
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe.exe
                                                                                                                                                  • Size 4.5MB
                                                                                                                                                  • SHA256 70b549da342e6906256244fe1615d7b45ddd6915f24e4dfadd3f04dcabe447b0
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe.exe
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe.exe
                                                                                                                                                  • Size 4.4MB
                                                                                                                                                  • SHA256 8fab9c2321314a90692d3863b50b814288331ac7acfc3b6a5408c9fa9a8d8fb0
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe.exe
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe.exe
                                                                                                                                                  • Size 4.3MB
                                                                                                                                                  • SHA256 07ea2f61aa357736a4526153a8bd5dc05b814e5b51d130af42f16177de7d623d
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe.exe
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe.exe
                                                                                                                                                  • Size 4.3MB
                                                                                                                                                  • SHA256 eec99459282797a0a3731044085bdb377fa9cea6d2aa9b250595b2a8e305ece0
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe.exe
                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\1515867ce087e4719f41b74c01c6cfa186a55815472576c5075a29a8f714f53e.exe.exe
                                                                                                                                                  • Size 4.1MB
                                                                                                                                                  • SHA256 eb5cdf3afaff899af6f384d6d74153583b5f2765205743e6ee12ec789a4d0ab7
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  Dll.dll
                                                                                                                                                  • Path C:\Windows\Dll.dll
                                                                                                                                                  • Size 68KB
                                                                                                                                                  • SHA256 58902ae17338af4211e7e21eddb09671507b48740fa7056b9b7f7ab307da0168
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  Logo1_.exe
                                                                                                                                                  • Path C:\Windows\Logo1_.exe
                                                                                                                                                  • Size 32KB
                                                                                                                                                  • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                  Submit Download

                                                                                                                                                  _desktop.ini
                                                                                                                                                  • Path F:\$RECYCLE.BIN\_desktop.ini
                                                                                                                                                  • Size 10B
                                                                                                                                                  • SHA256 6f32c14d8a0712d435829019df23525a5b62bb2ca9b24874a6316ec374b3d04c
                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                  Submit Download

                                                                                                                                                  memory/252-82-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/428-6156-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/472-6170-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/936-35-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/996-6114-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/1004-6443-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/1120-6065-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/1132-0-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/1132-13-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/1228-6422-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/1272-6149-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/1388-6107-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/1400-5909-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/1496-5915-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/1592-6472-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/1592-6466-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/1684-5879-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/1816-51-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/1892-1866-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/1896-6121-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/1992-6184-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2064-287-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2152-6219-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2176-5988-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2284-6100-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2316-5789-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2320-6191-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2404-6450-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2420-1875-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2464-5837-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2568-5873-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2580-24-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2692-5921-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/2756-5903-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/3016-6429-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/3028-5946-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/3220-5855-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/3256-6346-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/3348-5867-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/3380-6436-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/3444-6457-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/3696-6023-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/3732-5952-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/3776-6135-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/4104-5885-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/4136-6093-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/4220-6408-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/4232-6128-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/4264-6401-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/4280-60-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/4328-5849-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/4336-10-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/4336-1791-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/4336-3121-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/4336-5655-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/4372-93-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/4496-6380-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/4620-5807-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/4644-5795-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/4784-6387-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/4820-5928-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/4824-6142-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/4900-5891-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/4984-6325-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/5032-6226-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/5088-6177-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/5136-5897-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/5216-5764-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/5424-6261-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/5440-6394-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/5592-5843-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/5636-6415-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/5640-6366-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/5668-6163-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/5856-5861-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/5980-73-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/6160-6198-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/6168-5934-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/6220-5825-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/6236-5813-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/6272-6072-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/6280-6339-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/6320-6464-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/6332-6086-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/6368-5653-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/6376-6212-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/6444-5958-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/6448-6233-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/6464-6079-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/6488-5801-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/6516-6310-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/6544-5747-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/6740-5964-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/6776-6240-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/6816-5681-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/6860-6352-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/6920-5690-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/6932-4878-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/6936-5995-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/6992-5982-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/7012-5976-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/7028-6359-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/7032-5819-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/7040-5831-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/7072-6373-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/7076-6254-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/7112-5701-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/7196-5712-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/7308-5752-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/7312-6332-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/7380-5778-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/7380-5721-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/7424-6002-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/7452-5727-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/7468-6275-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/7484-6268-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/7532-6282-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/7560-5733-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/7620-6289-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/7636-6009-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/7640-5739-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/7672-6296-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/7724-5745-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/7748-6016-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/7804-6205-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/7876-5940-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/7888-5758-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/7908-6303-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/7968-6037-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/7972-5669-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/7996-6044-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/8008-5770-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/8032-6030-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/8044-6247-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/8056-6051-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/8068-6318-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/8136-5776-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/8168-6058-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/8176-5783-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download

                                                                                                                                                  memory/8180-5970-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                  Download