Overview

overview

9

Static

static

830004.exe

windows7-x64

9

830004.exe

windows10-2004-x64

9

Resubmissions

05-10-2022 11:39

221005-nsrtyaedfm 9

05-10-2022 08:12

221005-j3wtesdfg7 9

05-10-2022 06:56

221005-hqhwcsdeg8 9

Analysis

  • max time kernel
    480s
  • max time network
    430s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05-10-2022 08:12

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    830004.exe

  • Size

    691KB

  • MD5

    58aea2aac89947773dfae8e3859e20b0

  • SHA1

    be17c41c65703f9475e36dff55fd3de220e395f3

  • SHA256

    39b74b2fb057e8c78a2ba6639cf3d58ae91685e6ac13b57b70d2afb158cf742d

  • SHA512

    f3d43c0759b05b949498cc63084b54b869c228a427f1590a1010007b4bdbebf760145a29e5f1a7c5585133ed76a3c1a5d7bf2ace46858ac9a48ff5c05eafa6eb

  • SSDEEP

    12288:i0iads6yn93ySQDWYgeWYg955/155/m6q5iKn3zMCO342FoqdXS:dicFyn93ySQJ5f34Jo2Fi

Score
9/10
persistenceransomwarespywarestealer

Malware Config

Signatures

  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Modifies extensions of user files 10 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Delays execution with timeout.exe 64 IoCs
    evasion
  • Enumerates processes with tasklist 1 TTPs 64 IoCs
  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Kills process with taskkill 10 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
    adwarespyware
  • Modifies registry class 20 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • Runs net.exe
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\830004.exe
    "C:\Users\Admin\AppData\Local\Temp\830004.exe"
    1⤵
    • Modifies extensions of user files
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2220
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\ProgramData\Microsoft\Settings\0t4Q7u1v2.bat
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3616
      • C:\Windows\system32\tasklist.exe
        TASKLIST
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:4820
      • C:\Windows\system32\findstr.exe
        FINDSTR /B /L /I /C:830004.exe
        3⤵
          PID:3296
        • C:\Windows\system32\timeout.exe
          TIMEOUT /T 1 /NOBREAK
          3⤵
          • Delays execution with timeout.exe
          PID:4576
        • C:\Windows\system32\tasklist.exe
          TASKLIST
          3⤵
          • Enumerates processes with tasklist
          • Suspicious use of AdjustPrivilegeToken
          PID:3464
        • C:\Windows\system32\findstr.exe
          FINDSTR /B /L /I /C:830004.exe
          3⤵
            PID:4840
          • C:\Windows\system32\timeout.exe
            TIMEOUT /T 1 /NOBREAK
            3⤵
              PID:1828
            • C:\Windows\system32\tasklist.exe
              TASKLIST
              3⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:1700
            • C:\Windows\system32\findstr.exe
              FINDSTR /B /L /I /C:830004.exe
              3⤵
                PID:4996
              • C:\Windows\system32\timeout.exe
                TIMEOUT /T 1 /NOBREAK
                3⤵
                  PID:1044
                • C:\Windows\system32\tasklist.exe
                  TASKLIST
                  3⤵
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1116
                • C:\Windows\system32\findstr.exe
                  FINDSTR /B /L /I /C:830004.exe
                  3⤵
                    PID:1140
                  • C:\Windows\system32\timeout.exe
                    TIMEOUT /T 1 /NOBREAK
                    3⤵
                      PID:2124
                    • C:\Windows\system32\tasklist.exe
                      TASKLIST
                      3⤵
                      • Suspicious use of AdjustPrivilegeToken
                      PID:228
                    • C:\Windows\system32\findstr.exe
                      FINDSTR /B /L /I /C:830004.exe
                      3⤵
                        PID:116
                      • C:\Windows\system32\timeout.exe
                        TIMEOUT /T 1 /NOBREAK
                        3⤵
                          PID:2676
                        • C:\Windows\system32\tasklist.exe
                          TASKLIST
                          3⤵
                          • Enumerates processes with tasklist
                          • Suspicious use of AdjustPrivilegeToken
                          PID:4292
                        • C:\Windows\system32\findstr.exe
                          FINDSTR /B /L /I /C:830004.exe
                          3⤵
                            PID:3568
                          • C:\Windows\system32\timeout.exe
                            TIMEOUT /T 1 /NOBREAK
                            3⤵
                              PID:3796
                            • C:\Windows\system32\tasklist.exe
                              TASKLIST
                              3⤵
                              • Suspicious use of AdjustPrivilegeToken
                              PID:3692
                            • C:\Windows\system32\findstr.exe
                              FINDSTR /B /L /I /C:830004.exe
                              3⤵
                                PID:3660
                              • C:\Windows\system32\timeout.exe
                                TIMEOUT /T 1 /NOBREAK
                                3⤵
                                  PID:3716
                                • C:\Windows\system32\tasklist.exe
                                  TASKLIST
                                  3⤵
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:3452
                                • C:\Windows\system32\findstr.exe
                                  FINDSTR /B /L /I /C:830004.exe
                                  3⤵
                                    PID:3696
                                  • C:\Windows\system32\timeout.exe
                                    TIMEOUT /T 1 /NOBREAK
                                    3⤵
                                      PID:4464
                                    • C:\Windows\system32\tasklist.exe
                                      TASKLIST
                                      3⤵
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:4336
                                    • C:\Windows\system32\findstr.exe
                                      FINDSTR /B /L /I /C:830004.exe
                                      3⤵
                                        PID:4704
                                      • C:\Windows\system32\timeout.exe
                                        TIMEOUT /T 1 /NOBREAK
                                        3⤵
                                        • Delays execution with timeout.exe
                                        PID:3312
                                      • C:\Windows\system32\tasklist.exe
                                        TASKLIST
                                        3⤵
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:680
                                      • C:\Windows\system32\findstr.exe
                                        FINDSTR /B /L /I /C:830004.exe
                                        3⤵
                                          PID:3916
                                        • C:\Windows\system32\timeout.exe
                                          TIMEOUT /T 1 /NOBREAK
                                          3⤵
                                          • Delays execution with timeout.exe
                                          PID:3964
                                        • C:\Windows\system32\tasklist.exe
                                          TASKLIST
                                          3⤵
                                          • Enumerates processes with tasklist
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:2712
                                        • C:\Windows\system32\findstr.exe
                                          FINDSTR /B /L /I /C:830004.exe
                                          3⤵
                                            PID:3396
                                          • C:\Windows\system32\timeout.exe
                                            TIMEOUT /T 1 /NOBREAK
                                            3⤵
                                              PID:2656
                                            • C:\Windows\system32\tasklist.exe
                                              TASKLIST
                                              3⤵
                                              • Enumerates processes with tasklist
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:4716
                                            • C:\Windows\system32\findstr.exe
                                              FINDSTR /B /L /I /C:830004.exe
                                              3⤵
                                                PID:1652
                                              • C:\Windows\system32\timeout.exe
                                                TIMEOUT /T 1 /NOBREAK
                                                3⤵
                                                  PID:1112
                                                • C:\Windows\system32\tasklist.exe
                                                  TASKLIST
                                                  3⤵
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:992
                                                • C:\Windows\system32\findstr.exe
                                                  FINDSTR /B /L /I /C:830004.exe
                                                  3⤵
                                                    PID:2336
                                                  • C:\Windows\system32\timeout.exe
                                                    TIMEOUT /T 1 /NOBREAK
                                                    3⤵
                                                    • Delays execution with timeout.exe
                                                    PID:1600
                                                  • C:\Windows\system32\tasklist.exe
                                                    TASKLIST
                                                    3⤵
                                                    • Enumerates processes with tasklist
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    PID:2696
                                                  • C:\Windows\system32\findstr.exe
                                                    FINDSTR /B /L /I /C:830004.exe
                                                    3⤵
                                                      PID:4468
                                                    • C:\Windows\system32\timeout.exe
                                                      TIMEOUT /T 1 /NOBREAK
                                                      3⤵
                                                      • Delays execution with timeout.exe
                                                      PID:5064
                                                    • C:\Windows\system32\tasklist.exe
                                                      TASKLIST
                                                      3⤵
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      PID:3064
                                                    • C:\Windows\system32\findstr.exe
                                                      FINDSTR /B /L /I /C:830004.exe
                                                      3⤵
                                                        PID:376
                                                      • C:\Windows\system32\timeout.exe
                                                        TIMEOUT /T 1 /NOBREAK
                                                        3⤵
                                                          PID:4712
                                                        • C:\Windows\system32\tasklist.exe
                                                          TASKLIST
                                                          3⤵
                                                          • Enumerates processes with tasklist
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:4588
                                                        • C:\Windows\system32\findstr.exe
                                                          FINDSTR /B /L /I /C:830004.exe
                                                          3⤵
                                                            PID:2236
                                                          • C:\Windows\system32\timeout.exe
                                                            TIMEOUT /T 1 /NOBREAK
                                                            3⤵
                                                              PID:3984
                                                            • C:\Windows\system32\tasklist.exe
                                                              TASKLIST
                                                              3⤵
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:3988
                                                            • C:\Windows\system32\findstr.exe
                                                              FINDSTR /B /L /I /C:830004.exe
                                                              3⤵
                                                                PID:2472
                                                              • C:\Windows\system32\timeout.exe
                                                                TIMEOUT /T 1 /NOBREAK
                                                                3⤵
                                                                • Delays execution with timeout.exe
                                                                PID:2100
                                                              • C:\Windows\system32\tasklist.exe
                                                                TASKLIST
                                                                3⤵
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                PID:2896
                                                              • C:\Windows\system32\findstr.exe
                                                                FINDSTR /B /L /I /C:830004.exe
                                                                3⤵
                                                                  PID:2928
                                                                • C:\Windows\system32\timeout.exe
                                                                  TIMEOUT /T 1 /NOBREAK
                                                                  3⤵
                                                                  • Delays execution with timeout.exe
                                                                  PID:3952
                                                                • C:\Windows\system32\tasklist.exe
                                                                  TASKLIST
                                                                  3⤵
                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                  PID:3292
                                                                • C:\Windows\system32\findstr.exe
                                                                  FINDSTR /B /L /I /C:830004.exe
                                                                  3⤵
                                                                    PID:4156
                                                                  • C:\Windows\system32\timeout.exe
                                                                    TIMEOUT /T 1 /NOBREAK
                                                                    3⤵
                                                                      PID:4924
                                                                    • C:\Windows\system32\tasklist.exe
                                                                      TASKLIST
                                                                      3⤵
                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                      PID:8
                                                                    • C:\Windows\system32\findstr.exe
                                                                      FINDSTR /B /L /I /C:830004.exe
                                                                      3⤵
                                                                        PID:4972
                                                                      • C:\Windows\system32\timeout.exe
                                                                        TIMEOUT /T 1 /NOBREAK
                                                                        3⤵
                                                                        • Delays execution with timeout.exe
                                                                        PID:3476
                                                                      • C:\Windows\system32\tasklist.exe
                                                                        TASKLIST
                                                                        3⤵
                                                                        • Enumerates processes with tasklist
                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                        PID:528
                                                                      • C:\Windows\system32\findstr.exe
                                                                        FINDSTR /B /L /I /C:830004.exe
                                                                        3⤵
                                                                          PID:4260
                                                                        • C:\Windows\system32\timeout.exe
                                                                          TIMEOUT /T 1 /NOBREAK
                                                                          3⤵
                                                                            PID:636
                                                                          • C:\Windows\system32\tasklist.exe
                                                                            TASKLIST
                                                                            3⤵
                                                                            • Enumerates processes with tasklist
                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                            PID:3420
                                                                          • C:\Windows\system32\findstr.exe
                                                                            FINDSTR /B /L /I /C:830004.exe
                                                                            3⤵
                                                                              PID:4440
                                                                            • C:\Windows\system32\timeout.exe
                                                                              TIMEOUT /T 1 /NOBREAK
                                                                              3⤵
                                                                                PID:1764
                                                                              • C:\Windows\system32\tasklist.exe
                                                                                TASKLIST
                                                                                3⤵
                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                PID:2060
                                                                              • C:\Windows\system32\findstr.exe
                                                                                FINDSTR /B /L /I /C:830004.exe
                                                                                3⤵
                                                                                  PID:1120
                                                                                • C:\Windows\system32\timeout.exe
                                                                                  TIMEOUT /T 1 /NOBREAK
                                                                                  3⤵
                                                                                  • Delays execution with timeout.exe
                                                                                  PID:4640
                                                                                • C:\Windows\system32\tasklist.exe
                                                                                  TASKLIST
                                                                                  3⤵
                                                                                  • Enumerates processes with tasklist
                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                  PID:632
                                                                                • C:\Windows\system32\findstr.exe
                                                                                  FINDSTR /B /L /I /C:830004.exe
                                                                                  3⤵
                                                                                    PID:3088
                                                                                  • C:\Windows\system32\timeout.exe
                                                                                    TIMEOUT /T 1 /NOBREAK
                                                                                    3⤵
                                                                                      PID:4244
                                                                                    • C:\Windows\system32\tasklist.exe
                                                                                      TASKLIST
                                                                                      3⤵
                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                      PID:2468
                                                                                    • C:\Windows\system32\findstr.exe
                                                                                      FINDSTR /B /L /I /C:830004.exe
                                                                                      3⤵
                                                                                        PID:348
                                                                                      • C:\Windows\system32\timeout.exe
                                                                                        TIMEOUT /T 1 /NOBREAK
                                                                                        3⤵
                                                                                        • Delays execution with timeout.exe
                                                                                        PID:2056
                                                                                      • C:\Windows\system32\tasklist.exe
                                                                                        TASKLIST
                                                                                        3⤵
                                                                                        • Enumerates processes with tasklist
                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                        PID:1684
                                                                                      • C:\Windows\system32\findstr.exe
                                                                                        FINDSTR /B /L /I /C:830004.exe
                                                                                        3⤵
                                                                                          PID:1728
                                                                                        • C:\Windows\system32\timeout.exe
                                                                                          TIMEOUT /T 1 /NOBREAK
                                                                                          3⤵
                                                                                            PID:3676
                                                                                          • C:\Windows\system32\tasklist.exe
                                                                                            TASKLIST
                                                                                            3⤵
                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                            PID:3680
                                                                                          • C:\Windows\system32\findstr.exe
                                                                                            FINDSTR /B /L /I /C:830004.exe
                                                                                            3⤵
                                                                                              PID:3536
                                                                                            • C:\Windows\system32\timeout.exe
                                                                                              TIMEOUT /T 1 /NOBREAK
                                                                                              3⤵
                                                                                                PID:3668
                                                                                              • C:\Windows\system32\tasklist.exe
                                                                                                TASKLIST
                                                                                                3⤵
                                                                                                • Enumerates processes with tasklist
                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                PID:3980
                                                                                              • C:\Windows\system32\findstr.exe
                                                                                                FINDSTR /B /L /I /C:830004.exe
                                                                                                3⤵
                                                                                                  PID:4644
                                                                                                • C:\Windows\system32\timeout.exe
                                                                                                  TIMEOUT /T 1 /NOBREAK
                                                                                                  3⤵
                                                                                                    PID:4144
                                                                                                  • C:\Windows\system32\tasklist.exe
                                                                                                    TASKLIST
                                                                                                    3⤵
                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                    PID:4464
                                                                                                  • C:\Windows\system32\findstr.exe
                                                                                                    FINDSTR /B /L /I /C:830004.exe
                                                                                                    3⤵
                                                                                                      PID:4264
                                                                                                    • C:\Windows\system32\timeout.exe
                                                                                                      TIMEOUT /T 1 /NOBREAK
                                                                                                      3⤵
                                                                                                      • Delays execution with timeout.exe
                                                                                                      PID:1036
                                                                                                    • C:\Windows\system32\tasklist.exe
                                                                                                      TASKLIST
                                                                                                      3⤵
                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                      PID:4000
                                                                                                    • C:\Windows\system32\findstr.exe
                                                                                                      FINDSTR /B /L /I /C:830004.exe
                                                                                                      3⤵
                                                                                                        PID:3152
                                                                                                      • C:\Windows\system32\timeout.exe
                                                                                                        TIMEOUT /T 1 /NOBREAK
                                                                                                        3⤵
                                                                                                        • Delays execution with timeout.exe
                                                                                                        PID:3352
                                                                                                      • C:\Windows\system32\tasklist.exe
                                                                                                        TASKLIST
                                                                                                        3⤵
                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                        PID:860
                                                                                                      • C:\Windows\system32\findstr.exe
                                                                                                        FINDSTR /B /L /I /C:830004.exe
                                                                                                        3⤵
                                                                                                          PID:1928
                                                                                                        • C:\Windows\system32\timeout.exe
                                                                                                          TIMEOUT /T 1 /NOBREAK
                                                                                                          3⤵
                                                                                                            PID:3564
                                                                                                          • C:\Windows\system32\tasklist.exe
                                                                                                            TASKLIST
                                                                                                            3⤵
                                                                                                            • Enumerates processes with tasklist
                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                            PID:5116
                                                                                                          • C:\Windows\system32\findstr.exe
                                                                                                            FINDSTR /B /L /I /C:830004.exe
                                                                                                            3⤵
                                                                                                              PID:2712
                                                                                                            • C:\Windows\system32\timeout.exe
                                                                                                              TIMEOUT /T 1 /NOBREAK
                                                                                                              3⤵
                                                                                                              • Delays execution with timeout.exe
                                                                                                              PID:1156
                                                                                                            • C:\Windows\system32\tasklist.exe
                                                                                                              TASKLIST
                                                                                                              3⤵
                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                              PID:4716
                                                                                                            • C:\Windows\system32\findstr.exe
                                                                                                              FINDSTR /B /L /I /C:830004.exe
                                                                                                              3⤵
                                                                                                                PID:1652
                                                                                                              • C:\Windows\system32\timeout.exe
                                                                                                                TIMEOUT /T 1 /NOBREAK
                                                                                                                3⤵
                                                                                                                  PID:3240
                                                                                                                • C:\Windows\system32\tasklist.exe
                                                                                                                  TASKLIST
                                                                                                                  3⤵
                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                  PID:2740
                                                                                                                • C:\Windows\system32\findstr.exe
                                                                                                                  FINDSTR /B /L /I /C:830004.exe
                                                                                                                  3⤵
                                                                                                                    PID:992
                                                                                                                  • C:\Windows\system32\timeout.exe
                                                                                                                    TIMEOUT /T 1 /NOBREAK
                                                                                                                    3⤵
                                                                                                                    • Delays execution with timeout.exe
                                                                                                                    PID:544
                                                                                                                  • C:\Windows\system32\tasklist.exe
                                                                                                                    TASKLIST
                                                                                                                    3⤵
                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                    PID:4884
                                                                                                                  • C:\Windows\system32\findstr.exe
                                                                                                                    FINDSTR /B /L /I /C:830004.exe
                                                                                                                    3⤵
                                                                                                                      PID:4984
                                                                                                                    • C:\Windows\system32\timeout.exe
                                                                                                                      TIMEOUT /T 1 /NOBREAK
                                                                                                                      3⤵
                                                                                                                        PID:5112
                                                                                                                      • C:\Windows\system32\tasklist.exe
                                                                                                                        TASKLIST
                                                                                                                        3⤵
                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                        PID:4060
                                                                                                                      • C:\Windows\system32\findstr.exe
                                                                                                                        FINDSTR /B /L /I /C:830004.exe
                                                                                                                        3⤵
                                                                                                                          PID:4684
                                                                                                                        • C:\Windows\system32\timeout.exe
                                                                                                                          TIMEOUT /T 1 /NOBREAK
                                                                                                                          3⤵
                                                                                                                            PID:376
                                                                                                                          • C:\Windows\system32\tasklist.exe
                                                                                                                            TASKLIST
                                                                                                                            3⤵
                                                                                                                            • Enumerates processes with tasklist
                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                            PID:3472
                                                                                                                          • C:\Windows\system32\findstr.exe
                                                                                                                            FINDSTR /B /L /I /C:830004.exe
                                                                                                                            3⤵
                                                                                                                              PID:4472
                                                                                                                            • C:\Windows\system32\timeout.exe
                                                                                                                              TIMEOUT /T 1 /NOBREAK
                                                                                                                              3⤵
                                                                                                                              • Delays execution with timeout.exe
                                                                                                                              PID:1692
                                                                                                                            • C:\Windows\system32\tasklist.exe
                                                                                                                              TASKLIST
                                                                                                                              3⤵
                                                                                                                              • Enumerates processes with tasklist
                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                              PID:2236
                                                                                                                            • C:\Windows\system32\findstr.exe
                                                                                                                              FINDSTR /B /L /I /C:830004.exe
                                                                                                                              3⤵
                                                                                                                                PID:4064
                                                                                                                              • C:\Windows\system32\timeout.exe
                                                                                                                                TIMEOUT /T 1 /NOBREAK
                                                                                                                                3⤵
                                                                                                                                  PID:1344
                                                                                                                                • C:\Windows\system32\tasklist.exe
                                                                                                                                  TASKLIST
                                                                                                                                  3⤵
                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                  PID:2668
                                                                                                                                • C:\Windows\system32\findstr.exe
                                                                                                                                  FINDSTR /B /L /I /C:830004.exe
                                                                                                                                  3⤵
                                                                                                                                    PID:4812
                                                                                                                                  • C:\Windows\system32\timeout.exe
                                                                                                                                    TIMEOUT /T 1 /NOBREAK
                                                                                                                                    3⤵
                                                                                                                                    • Delays execution with timeout.exe
                                                                                                                                    PID:2100
                                                                                                                                  • C:\Windows\system32\tasklist.exe
                                                                                                                                    TASKLIST
                                                                                                                                    3⤵
                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                    PID:4896
                                                                                                                                  • C:\Windows\system32\findstr.exe
                                                                                                                                    FINDSTR /B /L /I /C:830004.exe
                                                                                                                                    3⤵
                                                                                                                                      PID:3288
                                                                                                                                    • C:\Windows\system32\timeout.exe
                                                                                                                                      TIMEOUT /T 1 /NOBREAK
                                                                                                                                      3⤵
                                                                                                                                        PID:4844
                                                                                                                                      • C:\Windows\system32\tasklist.exe
                                                                                                                                        TASKLIST
                                                                                                                                        3⤵
                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                        PID:452
                                                                                                                                      • C:\Windows\system32\findstr.exe
                                                                                                                                        FINDSTR /B /L /I /C:830004.exe
                                                                                                                                        3⤵
                                                                                                                                          PID:2708
                                                                                                                                        • C:\Windows\system32\timeout.exe
                                                                                                                                          TIMEOUT /T 1 /NOBREAK
                                                                                                                                          3⤵
                                                                                                                                            PID:1220
                                                                                                                                          • C:\Windows\system32\tasklist.exe
                                                                                                                                            TASKLIST
                                                                                                                                            3⤵
                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                            PID:4920
                                                                                                                                          • C:\Windows\system32\findstr.exe
                                                                                                                                            FINDSTR /B /L /I /C:830004.exe
                                                                                                                                            3⤵
                                                                                                                                              PID:4924
                                                                                                                                            • C:\Windows\system32\timeout.exe
                                                                                                                                              TIMEOUT /T 1 /NOBREAK
                                                                                                                                              3⤵
                                                                                                                                              • Delays execution with timeout.exe
                                                                                                                                              PID:8
                                                                                                                                            • C:\Windows\system32\tasklist.exe
                                                                                                                                              TASKLIST
                                                                                                                                              3⤵
                                                                                                                                              • Enumerates processes with tasklist
                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                              PID:4276
                                                                                                                                            • C:\Windows\system32\findstr.exe
                                                                                                                                              FINDSTR /B /L /I /C:830004.exe
                                                                                                                                              3⤵
                                                                                                                                                PID:3004
                                                                                                                                              • C:\Windows\system32\timeout.exe
                                                                                                                                                TIMEOUT /T 1 /NOBREAK
                                                                                                                                                3⤵
                                                                                                                                                  PID:528
                                                                                                                                                • C:\Windows\system32\tasklist.exe
                                                                                                                                                  TASKLIST
                                                                                                                                                  3⤵
                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                  PID:3784
                                                                                                                                                • C:\Windows\system32\findstr.exe
                                                                                                                                                  FINDSTR /B /L /I /C:830004.exe
                                                                                                                                                  3⤵
                                                                                                                                                    PID:5004
                                                                                                                                                  • C:\Windows\system32\timeout.exe
                                                                                                                                                    TIMEOUT /T 1 /NOBREAK
                                                                                                                                                    3⤵
                                                                                                                                                    • Delays execution with timeout.exe
                                                                                                                                                    PID:2348
                                                                                                                                                  • C:\Windows\system32\tasklist.exe
                                                                                                                                                    TASKLIST
                                                                                                                                                    3⤵
                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                    PID:4440
                                                                                                                                                  • C:\Windows\system32\findstr.exe
                                                                                                                                                    FINDSTR /B /L /I /C:830004.exe
                                                                                                                                                    3⤵
                                                                                                                                                      PID:3484
                                                                                                                                                    • C:\Windows\system32\timeout.exe
                                                                                                                                                      TIMEOUT /T 1 /NOBREAK
                                                                                                                                                      3⤵
                                                                                                                                                        PID:1976
                                                                                                                                                      • C:\Windows\system32\tasklist.exe
                                                                                                                                                        TASKLIST
                                                                                                                                                        3⤵
                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                        PID:1436
                                                                                                                                                      • C:\Windows\system32\findstr.exe
                                                                                                                                                        FINDSTR /B /L /I /C:830004.exe
                                                                                                                                                        3⤵
                                                                                                                                                          PID:1052
                                                                                                                                                        • C:\Windows\system32\timeout.exe
                                                                                                                                                          TIMEOUT /T 1 /NOBREAK
                                                                                                                                                          3⤵
                                                                                                                                                          • Delays execution with timeout.exe
                                                                                                                                                          PID:2960
                                                                                                                                                        • C:\Windows\system32\tasklist.exe
                                                                                                                                                          TASKLIST
                                                                                                                                                          3⤵
                                                                                                                                                          • Enumerates processes with tasklist
                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                          PID:3912
                                                                                                                                                        • C:\Windows\system32\findstr.exe
                                                                                                                                                          FINDSTR /B /L /I /C:830004.exe
                                                                                                                                                          3⤵
                                                                                                                                                            PID:3060
                                                                                                                                                          • C:\Windows\system32\timeout.exe
                                                                                                                                                            TIMEOUT /T 1 /NOBREAK
                                                                                                                                                            3⤵
                                                                                                                                                            • Delays execution with timeout.exe
                                                                                                                                                            PID:1116
                                                                                                                                                          • C:\Windows\system32\tasklist.exe
                                                                                                                                                            TASKLIST
                                                                                                                                                            3⤵
                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                            PID:3920
                                                                                                                                                          • C:\Windows\system32\findstr.exe
                                                                                                                                                            FINDSTR /B /L /I /C:830004.exe
                                                                                                                                                            3⤵
                                                                                                                                                              PID:208
                                                                                                                                                            • C:\Windows\system32\timeout.exe
                                                                                                                                                              TIMEOUT /T 1 /NOBREAK
                                                                                                                                                              3⤵
                                                                                                                                                              • Delays execution with timeout.exe
                                                                                                                                                              PID:1796
                                                                                                                                                            • C:\Windows\system32\tasklist.exe
                                                                                                                                                              TASKLIST
                                                                                                                                                              3⤵
                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                              PID:5008
                                                                                                                                                            • C:\Windows\system32\findstr.exe
                                                                                                                                                              FINDSTR /B /L /I /C:830004.exe
                                                                                                                                                              3⤵
                                                                                                                                                                PID:4996
                                                                                                                                                              • C:\Windows\system32\timeout.exe
                                                                                                                                                                TIMEOUT /T 1 /NOBREAK
                                                                                                                                                                3⤵
                                                                                                                                                                  PID:3568
                                                                                                                                                                • C:\Windows\system32\tasklist.exe
                                                                                                                                                                  TASKLIST
                                                                                                                                                                  3⤵
                                                                                                                                                                  • Enumerates processes with tasklist
                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                  PID:4292
                                                                                                                                                                • C:\Windows\system32\findstr.exe
                                                                                                                                                                  FINDSTR /B /L /I /C:830004.exe
                                                                                                                                                                  3⤵
                                                                                                                                                                    PID:3796
                                                                                                                                                                  • C:\Windows\system32\timeout.exe
                                                                                                                                                                    TIMEOUT /T 1 /NOBREAK
                                                                                                                                                                    3⤵
                                                                                                                                                                    • Delays execution with timeout.exe
                                                                                                                                                                    PID:3540
                                                                                                                                                                  • C:\Windows\system32\tasklist.exe
                                                                                                                                                                    TASKLIST
                                                                                                                                                                    3⤵
                                                                                                                                                                    • Enumerates processes with tasklist
                                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                    PID:3692
                                                                                                                                                                  • C:\Windows\system32\findstr.exe
                                                                                                                                                                    FINDSTR /B /L /I /C:830004.exe
                                                                                                                                                                    3⤵
                                                                                                                                                                      PID:3572
                                                                                                                                                                    • C:\Windows\system32\timeout.exe
                                                                                                                                                                      TIMEOUT /T 1 /NOBREAK
                                                                                                                                                                      3⤵
                                                                                                                                                                        PID:624
                                                                                                                                                                      • C:\Windows\system32\tasklist.exe
                                                                                                                                                                        TASKLIST
                                                                                                                                                                        3⤵
                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                        PID:4092
                                                                                                                                                                      • C:\Windows\system32\findstr.exe
                                                                                                                                                                        FINDSTR /B /L /I /C:830004.exe
                                                                                                                                                                        3⤵
                                                                                                                                                                          PID:4364
                                                                                                                                                                        • C:\Windows\system32\timeout.exe
                                                                                                                                                                          TIMEOUT /T 1 /NOBREAK
                                                                                                                                                                          3⤵
                                                                                                                                                                          • Delays execution with timeout.exe
                                                                                                                                                                          PID:4336
                                                                                                                                                                        • C:\Windows\system32\tasklist.exe
                                                                                                                                                                          TASKLIST
                                                                                                                                                                          3⤵
                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                          PID:3304
                                                                                                                                                                        • C:\Windows\system32\findstr.exe
                                                                                                                                                                          FINDSTR /B /L /I /C:830004.exe
                                                                                                                                                                          3⤵
                                                                                                                                                                            PID:1496
                                                                                                                                                                          • C:\Windows\system32\timeout.exe
                                                                                                                                                                            TIMEOUT /T 1 /NOBREAK
                                                                                                                                                                            3⤵
                                                                                                                                                                            • Delays execution with timeout.exe
                                                                                                                                                                            PID:396
                                                                                                                                                                          • C:\Windows\system32\tasklist.exe
                                                                                                                                                                            TASKLIST
                                                                                                                                                                            3⤵
                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                            PID:2328
                                                                                                                                                                          • C:\Windows\system32\findstr.exe
                                                                                                                                                                            FINDSTR /B /L /I /C:830004.exe
                                                                                                                                                                            3⤵
                                                                                                                                                                              PID:2344
                                                                                                                                                                            • C:\Windows\system32\timeout.exe
                                                                                                                                                                              TIMEOUT /T 1 /NOBREAK
                                                                                                                                                                              3⤵
                                                                                                                                                                              • Delays execution with timeout.exe
                                                                                                                                                                              PID:2416
                                                                                                                                                                            • C:\Windows\system32\tasklist.exe
                                                                                                                                                                              TASKLIST
                                                                                                                                                                              3⤵
                                                                                                                                                                                PID:3916
                                                                                                                                                                              • C:\Windows\system32\findstr.exe
                                                                                                                                                                                FINDSTR /B /L /I /C:830004.exe
                                                                                                                                                                                3⤵
                                                                                                                                                                                  PID:2332
                                                                                                                                                                                • C:\Windows\system32\timeout.exe
                                                                                                                                                                                  TIMEOUT /T 1 /NOBREAK
                                                                                                                                                                                  3⤵
                                                                                                                                                                                  • Delays execution with timeout.exe
                                                                                                                                                                                  PID:2656
                                                                                                                                                                                • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                  TASKLIST
                                                                                                                                                                                  3⤵
                                                                                                                                                                                  • Enumerates processes with tasklist
                                                                                                                                                                                  PID:5116
                                                                                                                                                                                • C:\Windows\system32\findstr.exe
                                                                                                                                                                                  FINDSTR /B /L /I /C:830004.exe
                                                                                                                                                                                  3⤵
                                                                                                                                                                                    PID:64
                                                                                                                                                                                  • C:\Windows\system32\timeout.exe
                                                                                                                                                                                    TIMEOUT /T 1 /NOBREAK
                                                                                                                                                                                    3⤵
                                                                                                                                                                                    • Delays execution with timeout.exe
                                                                                                                                                                                    PID:4036
                                                                                                                                                                                  • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                    TASKLIST
                                                                                                                                                                                    3⤵
                                                                                                                                                                                    • Enumerates processes with tasklist
                                                                                                                                                                                    PID:1096
                                                                                                                                                                                  • C:\Windows\system32\findstr.exe
                                                                                                                                                                                    FINDSTR /B /L /I /C:830004.exe
                                                                                                                                                                                    3⤵
                                                                                                                                                                                      PID:4664
                                                                                                                                                                                    • C:\Windows\system32\timeout.exe
                                                                                                                                                                                      TIMEOUT /T 1 /NOBREAK
                                                                                                                                                                                      3⤵
                                                                                                                                                                                      • Delays execution with timeout.exe
                                                                                                                                                                                      PID:2464
                                                                                                                                                                                    • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                      TASKLIST
                                                                                                                                                                                      3⤵
                                                                                                                                                                                        PID:992
                                                                                                                                                                                      • C:\Windows\system32\findstr.exe
                                                                                                                                                                                        FINDSTR /B /L /I /C:830004.exe
                                                                                                                                                                                        3⤵
                                                                                                                                                                                          PID:4488
                                                                                                                                                                                        • C:\Windows\system32\timeout.exe
                                                                                                                                                                                          TIMEOUT /T 1 /NOBREAK
                                                                                                                                                                                          3⤵
                                                                                                                                                                                            PID:3172
                                                                                                                                                                                          • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                            TASKLIST
                                                                                                                                                                                            3⤵
                                                                                                                                                                                              PID:3848
                                                                                                                                                                                            • C:\Windows\system32\findstr.exe
                                                                                                                                                                                              FINDSTR /B /L /I /C:830004.exe
                                                                                                                                                                                              3⤵
                                                                                                                                                                                                PID:1548
                                                                                                                                                                                              • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                TIMEOUT /T 1 /NOBREAK
                                                                                                                                                                                                3⤵
                                                                                                                                                                                                • Delays execution with timeout.exe
                                                                                                                                                                                                PID:5100
                                                                                                                                                                                              • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                                TASKLIST
                                                                                                                                                                                                3⤵
                                                                                                                                                                                                • Enumerates processes with tasklist
                                                                                                                                                                                                PID:3008
                                                                                                                                                                                              • C:\Windows\system32\findstr.exe
                                                                                                                                                                                                FINDSTR /B /L /I /C:830004.exe
                                                                                                                                                                                                3⤵
                                                                                                                                                                                                  PID:3900
                                                                                                                                                                                                • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                  TIMEOUT /T 1 /NOBREAK
                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                    PID:4380
                                                                                                                                                                                                  • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                                    TASKLIST
                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                      PID:4020
                                                                                                                                                                                                    • C:\Windows\system32\findstr.exe
                                                                                                                                                                                                      FINDSTR /B /L /I /C:830004.exe
                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                        PID:3064
                                                                                                                                                                                                      • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                        TIMEOUT /T 1 /NOBREAK
                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                        • Delays execution with timeout.exe
                                                                                                                                                                                                        PID:4548
                                                                                                                                                                                                      • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                                        TASKLIST
                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                          PID:3248
                                                                                                                                                                                                        • C:\Windows\system32\findstr.exe
                                                                                                                                                                                                          FINDSTR /B /L /I /C:830004.exe
                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                            PID:900
                                                                                                                                                                                                          • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                            TIMEOUT /T 1 /NOBREAK
                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                            • Delays execution with timeout.exe
                                                                                                                                                                                                            PID:4712
                                                                                                                                                                                                          • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                                            TASKLIST
                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                            • Enumerates processes with tasklist
                                                                                                                                                                                                            PID:4588
                                                                                                                                                                                                          • C:\Windows\system32\findstr.exe
                                                                                                                                                                                                            FINDSTR /B /L /I /C:830004.exe
                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                              PID:1692
                                                                                                                                                                                                            • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                              TIMEOUT /T 1 /NOBREAK
                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                              • Delays execution with timeout.exe
                                                                                                                                                                                                              PID:3992
                                                                                                                                                                                                            • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                                              TASKLIST
                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                              • Enumerates processes with tasklist
                                                                                                                                                                                                              PID:2484
                                                                                                                                                                                                            • C:\Windows\system32\findstr.exe
                                                                                                                                                                                                              FINDSTR /B /L /I /C:830004.exe
                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                PID:1344
                                                                                                                                                                                                              • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                TIMEOUT /T 1 /NOBREAK
                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                  PID:3988
                                                                                                                                                                                                                • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                                                  TASKLIST
                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                  • Enumerates processes with tasklist
                                                                                                                                                                                                                  PID:3148
                                                                                                                                                                                                                • C:\Windows\system32\findstr.exe
                                                                                                                                                                                                                  FINDSTR /B /L /I /C:830004.exe
                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                    PID:368
                                                                                                                                                                                                                  • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                    TIMEOUT /T 1 /NOBREAK
                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                      PID:4748
                                                                                                                                                                                                                    • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                                                      TASKLIST
                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                      • Enumerates processes with tasklist
                                                                                                                                                                                                                      PID:4896
                                                                                                                                                                                                                    • C:\Windows\system32\findstr.exe
                                                                                                                                                                                                                      FINDSTR /B /L /I /C:830004.exe
                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                        PID:3288
                                                                                                                                                                                                                      • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                        TIMEOUT /T 1 /NOBREAK
                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                        • Delays execution with timeout.exe
                                                                                                                                                                                                                        PID:3292
                                                                                                                                                                                                                      • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                                                        TASKLIST
                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                        • Enumerates processes with tasklist
                                                                                                                                                                                                                        PID:3120
                                                                                                                                                                                                                      • C:\Windows\system32\findstr.exe
                                                                                                                                                                                                                        FINDSTR /B /L /I /C:830004.exe
                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                          PID:2708
                                                                                                                                                                                                                        • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                          TIMEOUT /T 1 /NOBREAK
                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                            PID:3812
                                                                                                                                                                                                                          • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                                                            TASKLIST
                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                            • Enumerates processes with tasklist
                                                                                                                                                                                                                            PID:4932
                                                                                                                                                                                                                          • C:\Windows\system32\findstr.exe
                                                                                                                                                                                                                            FINDSTR /B /L /I /C:830004.exe
                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                              PID:4972
                                                                                                                                                                                                                            • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                              TIMEOUT /T 1 /NOBREAK
                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                              • Delays execution with timeout.exe
                                                                                                                                                                                                                              PID:5032
                                                                                                                                                                                                                            • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                                                              TASKLIST
                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                PID:3004
                                                                                                                                                                                                                              • C:\Windows\system32\findstr.exe
                                                                                                                                                                                                                                FINDSTR /B /L /I /C:830004.exe
                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                  PID:4300
                                                                                                                                                                                                                                • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                  TIMEOUT /T 1 /NOBREAK
                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                  • Delays execution with timeout.exe
                                                                                                                                                                                                                                  PID:636
                                                                                                                                                                                                                                • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                                                                  TASKLIST
                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                  • Enumerates processes with tasklist
                                                                                                                                                                                                                                  PID:3420
                                                                                                                                                                                                                                • C:\Windows\system32\findstr.exe
                                                                                                                                                                                                                                  FINDSTR /B /L /I /C:830004.exe
                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                    PID:1648
                                                                                                                                                                                                                                  • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                    TIMEOUT /T 1 /NOBREAK
                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                      PID:4440
                                                                                                                                                                                                                                    • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                                                                      TASKLIST
                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                      • Enumerates processes with tasklist
                                                                                                                                                                                                                                      PID:1168
                                                                                                                                                                                                                                    • C:\Windows\system32\findstr.exe
                                                                                                                                                                                                                                      FINDSTR /B /L /I /C:830004.exe
                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                        PID:4640
                                                                                                                                                                                                                                      • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                        TIMEOUT /T 1 /NOBREAK
                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                          PID:1524
                                                                                                                                                                                                                                        • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                                                                          TASKLIST
                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                          • Enumerates processes with tasklist
                                                                                                                                                                                                                                          PID:4612
                                                                                                                                                                                                                                        • C:\Windows\system32\findstr.exe
                                                                                                                                                                                                                                          FINDSTR /B /L /I /C:830004.exe
                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                            PID:632
                                                                                                                                                                                                                                          • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                            TIMEOUT /T 1 /NOBREAK
                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                            • Delays execution with timeout.exe
                                                                                                                                                                                                                                            PID:1872
                                                                                                                                                                                                                                          • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                                                                            TASKLIST
                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                            • Enumerates processes with tasklist
                                                                                                                                                                                                                                            PID:1116
                                                                                                                                                                                                                                          • C:\Windows\system32\findstr.exe
                                                                                                                                                                                                                                            FINDSTR /B /L /I /C:830004.exe
                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                              PID:2468
                                                                                                                                                                                                                                            • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                              TIMEOUT /T 1 /NOBREAK
                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                              • Delays execution with timeout.exe
                                                                                                                                                                                                                                              PID:208
                                                                                                                                                                                                                                            • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                                                                              TASKLIST
                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                              • Enumerates processes with tasklist
                                                                                                                                                                                                                                              PID:1796
                                                                                                                                                                                                                                            • C:\Windows\system32\findstr.exe
                                                                                                                                                                                                                                              FINDSTR /B /L /I /C:830004.exe
                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                PID:1812
                                                                                                                                                                                                                                              • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                TIMEOUT /T 1 /NOBREAK
                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                • Delays execution with timeout.exe
                                                                                                                                                                                                                                                PID:4996
                                                                                                                                                                                                                                              • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                                                                                TASKLIST
                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                  PID:3664
                                                                                                                                                                                                                                                • C:\Windows\system32\findstr.exe
                                                                                                                                                                                                                                                  FINDSTR /B /L /I /C:830004.exe
                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                    PID:2152
                                                                                                                                                                                                                                                  • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                    TIMEOUT /T 1 /NOBREAK
                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                      PID:1728
                                                                                                                                                                                                                                                    • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                                                                                      TASKLIST
                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                        PID:3796
                                                                                                                                                                                                                                                      • C:\Windows\system32\findstr.exe
                                                                                                                                                                                                                                                        FINDSTR /B /L /I /C:830004.exe
                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                          PID:2680
                                                                                                                                                                                                                                                        • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                          TIMEOUT /T 1 /NOBREAK
                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                          • Delays execution with timeout.exe
                                                                                                                                                                                                                                                          PID:3068
                                                                                                                                                                                                                                                        • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                                                                                          TASKLIST
                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                          • Enumerates processes with tasklist
                                                                                                                                                                                                                                                          PID:3552
                                                                                                                                                                                                                                                        • C:\Windows\system32\findstr.exe
                                                                                                                                                                                                                                                          FINDSTR /B /L /I /C:830004.exe
                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                            PID:3544
                                                                                                                                                                                                                                                          • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                            TIMEOUT /T 1 /NOBREAK
                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                              PID:3696
                                                                                                                                                                                                                                                            • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                                                                                              TASKLIST
                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                              • Enumerates processes with tasklist
                                                                                                                                                                                                                                                              PID:4644
                                                                                                                                                                                                                                                            • C:\Windows\system32\findstr.exe
                                                                                                                                                                                                                                                              FINDSTR /B /L /I /C:830004.exe
                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                PID:812
                                                                                                                                                                                                                                                              • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                                TIMEOUT /T 1 /NOBREAK
                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                  PID:3428
                                                                                                                                                                                                                                                                • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                                                                                                  TASKLIST
                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                    PID:4280
                                                                                                                                                                                                                                                                  • C:\Windows\system32\findstr.exe
                                                                                                                                                                                                                                                                    FINDSTR /B /L /I /C:830004.exe
                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                      PID:2380
                                                                                                                                                                                                                                                                    • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                                      TIMEOUT /T 1 /NOBREAK
                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                      • Delays execution with timeout.exe
                                                                                                                                                                                                                                                                      PID:3904
                                                                                                                                                                                                                                                                    • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                                                                                                      TASKLIST
                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                        PID:2276
                                                                                                                                                                                                                                                                      • C:\Windows\system32\findstr.exe
                                                                                                                                                                                                                                                                        FINDSTR /B /L /I /C:830004.exe
                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                          PID:4000
                                                                                                                                                                                                                                                                        • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                                          TIMEOUT /T 1 /NOBREAK
                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                          • Delays execution with timeout.exe
                                                                                                                                                                                                                                                                          PID:436
                                                                                                                                                                                                                                                                        • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                                                                                                          TASKLIST
                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                            PID:160
                                                                                                                                                                                                                                                                          • C:\Windows\system32\findstr.exe
                                                                                                                                                                                                                                                                            FINDSTR /B /L /I /C:830004.exe
                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                              PID:3648
                                                                                                                                                                                                                                                                            • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                                              TIMEOUT /T 1 /NOBREAK
                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                              • Delays execution with timeout.exe
                                                                                                                                                                                                                                                                              PID:3128
                                                                                                                                                                                                                                                                            • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                                                                                                              TASKLIST
                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                              • Enumerates processes with tasklist
                                                                                                                                                                                                                                                                              PID:860
                                                                                                                                                                                                                                                                            • C:\Windows\system32\findstr.exe
                                                                                                                                                                                                                                                                              FINDSTR /B /L /I /C:830004.exe
                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                PID:3396
                                                                                                                                                                                                                                                                              • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                                                TIMEOUT /T 1 /NOBREAK
                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                  PID:2656
                                                                                                                                                                                                                                                                                • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                                                                                                                  TASKLIST
                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                    PID:2712
                                                                                                                                                                                                                                                                                  • C:\Windows\system32\findstr.exe
                                                                                                                                                                                                                                                                                    FINDSTR /B /L /I /C:830004.exe
                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                      PID:4600
                                                                                                                                                                                                                                                                                    • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                                                      TIMEOUT /T 1 /NOBREAK
                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                      • Delays execution with timeout.exe
                                                                                                                                                                                                                                                                                      PID:4036
                                                                                                                                                                                                                                                                                    • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                                                                                                                      TASKLIST
                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                        PID:2420
                                                                                                                                                                                                                                                                                      • C:\Windows\system32\findstr.exe
                                                                                                                                                                                                                                                                                        FINDSTR /B /L /I /C:830004.exe
                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                          PID:2604
                                                                                                                                                                                                                                                                                        • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                                                          TIMEOUT /T 1 /NOBREAK
                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                            PID:2464
                                                                                                                                                                                                                                                                                          • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                                                                                                                            TASKLIST
                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                            • Enumerates processes with tasklist
                                                                                                                                                                                                                                                                                            PID:2724
                                                                                                                                                                                                                                                                                          • C:\Windows\system32\findstr.exe
                                                                                                                                                                                                                                                                                            FINDSTR /B /L /I /C:830004.exe
                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                              PID:2552
                                                                                                                                                                                                                                                                                            • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                                                              TIMEOUT /T 1 /NOBREAK
                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                PID:3344
                                                                                                                                                                                                                                                                                              • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                                                                                                                                TASKLIST
                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                  PID:4984
                                                                                                                                                                                                                                                                                                • C:\Windows\system32\findstr.exe
                                                                                                                                                                                                                                                                                                  FINDSTR /B /L /I /C:830004.exe
                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                    PID:4616
                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                                                                    TIMEOUT /T 1 /NOBREAK
                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                    • Delays execution with timeout.exe
                                                                                                                                                                                                                                                                                                    PID:3888
                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                                                                                                                                    TASKLIST
                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                      PID:2396
                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\findstr.exe
                                                                                                                                                                                                                                                                                                      FINDSTR /B /L /I /C:830004.exe
                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                        PID:388
                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                                                                        TIMEOUT /T 1 /NOBREAK
                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                          PID:5064
                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                                                                                                                                          TASKLIST
                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                          • Enumerates processes with tasklist
                                                                                                                                                                                                                                                                                                          PID:4564
                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\findstr.exe
                                                                                                                                                                                                                                                                                                          FINDSTR /B /L /I /C:830004.exe
                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                            PID:4560
                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                                                                            TIMEOUT /T 1 /NOBREAK
                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                            • Delays execution with timeout.exe
                                                                                                                                                                                                                                                                                                            PID:4684
                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                                                                                                                                            TASKLIST
                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                              PID:5028
                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\findstr.exe
                                                                                                                                                                                                                                                                                                              FINDSTR /B /L /I /C:830004.exe
                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                PID:1680
                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                                                                                TIMEOUT /T 1 /NOBREAK
                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                  PID:1516
                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                                                                                                                                                  TASKLIST
                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                    PID:4024
                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\findstr.exe
                                                                                                                                                                                                                                                                                                                    FINDSTR /B /L /I /C:830004.exe
                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                      PID:3984
                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                                                                                      TIMEOUT /T 1 /NOBREAK
                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                      • Delays execution with timeout.exe
                                                                                                                                                                                                                                                                                                                      PID:4064
                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                                                                                                                                                      TASKLIST
                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                      • Enumerates processes with tasklist
                                                                                                                                                                                                                                                                                                                      PID:4960
                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\findstr.exe
                                                                                                                                                                                                                                                                                                                      FINDSTR /B /L /I /C:830004.exe
                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                        PID:3860
                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                                                                                        TIMEOUT /T 1 /NOBREAK
                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                          PID:4812
                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                                                                                                                                                          TASKLIST
                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                            PID:2896
                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\findstr.exe
                                                                                                                                                                                                                                                                                                                            FINDSTR /B /L /I /C:830004.exe
                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                              PID:1396
                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                                                                                              TIMEOUT /T 1 /NOBREAK
                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                              • Delays execution with timeout.exe
                                                                                                                                                                                                                                                                                                                              PID:2928
                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                                                                                                                                                              TASKLIST
                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                PID:2140
                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\findstr.exe
                                                                                                                                                                                                                                                                                                                                FINDSTR /B /L /I /C:830004.exe
                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                  PID:2780
                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                                                                                                  TIMEOUT /T 1 /NOBREAK
                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                  • Delays execution with timeout.exe
                                                                                                                                                                                                                                                                                                                                  PID:4904
                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                                                                                                                                                                  TASKLIST
                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                    PID:5000
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\findstr.exe
                                                                                                                                                                                                                                                                                                                                    FINDSTR /B /L /I /C:830004.exe
                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                      PID:4876
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                                                                                                      TIMEOUT /T 1 /NOBREAK
                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                      • Delays execution with timeout.exe
                                                                                                                                                                                                                                                                                                                                      PID:5072
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                                                                                                                                                                      TASKLIST
                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                      • Enumerates processes with tasklist
                                                                                                                                                                                                                                                                                                                                      PID:1512
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\findstr.exe
                                                                                                                                                                                                                                                                                                                                      FINDSTR /B /L /I /C:830004.exe
                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                        PID:4780
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                                                                                                        TIMEOUT /T 1 /NOBREAK
                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                          PID:3672
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                                                                                                                                                                          TASKLIST
                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                          • Enumerates processes with tasklist
                                                                                                                                                                                                                                                                                                                                          PID:4972
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\findstr.exe
                                                                                                                                                                                                                                                                                                                                          FINDSTR /B /L /I /C:830004.exe
                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                            PID:3652
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                                                                                                            TIMEOUT /T 1 /NOBREAK
                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                              PID:4296
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                                                                                                                                                                              TASKLIST
                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                PID:3000
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\findstr.exe
                                                                                                                                                                                                                                                                                                                                                FINDSTR /B /L /I /C:830004.exe
                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                  PID:3004
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                                                                                                                  TIMEOUT /T 1 /NOBREAK
                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                    PID:672
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                                                                                                                                                                                    TASKLIST
                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                    • Enumerates processes with tasklist
                                                                                                                                                                                                                                                                                                                                                    PID:2292
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\findstr.exe
                                                                                                                                                                                                                                                                                                                                                    FINDSTR /B /L /I /C:830004.exe
                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                      PID:5012
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                                                                                                                      TIMEOUT /T 1 /NOBREAK
                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                      • Delays execution with timeout.exe
                                                                                                                                                                                                                                                                                                                                                      PID:3112
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                                                                                                                                                                                      TASKLIST
                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                        PID:3420
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\findstr.exe
                                                                                                                                                                                                                                                                                                                                                        FINDSTR /B /L /I /C:830004.exe
                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                          PID:1648
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                                                                                                                          TIMEOUT /T 1 /NOBREAK
                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                            PID:1436
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                                                                                                                                                                                            TASKLIST
                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                              PID:1168
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\findstr.exe
                                                                                                                                                                                                                                                                                                                                                              FINDSTR /B /L /I /C:830004.exe
                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                PID:4640
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                                                                                                                                TIMEOUT /T 1 /NOBREAK
                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                • Delays execution with timeout.exe
                                                                                                                                                                                                                                                                                                                                                                PID:380
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                                                                                                                                                                                                TASKLIST
                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:5024
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\findstr.exe
                                                                                                                                                                                                                                                                                                                                                                  FINDSTR /B /L /I /C:830004.exe
                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:632
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                                                                                                                                    TIMEOUT /T 1 /NOBREAK
                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:100
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                                                                                                                                                                                                      TASKLIST
                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                      • Enumerates processes with tasklist
                                                                                                                                                                                                                                                                                                                                                                      PID:2252
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\findstr.exe
                                                                                                                                                                                                                                                                                                                                                                      FINDSTR /B /L /I /C:830004.exe
                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:1116
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                                                                                                                                        TIMEOUT /T 1 /NOBREAK
                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                        • Delays execution with timeout.exe
                                                                                                                                                                                                                                                                                                                                                                        PID:3052
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                                                                                                                                                                                                        TASKLIST
                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:2840
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\findstr.exe
                                                                                                                                                                                                                                                                                                                                                                          FINDSTR /B /L /I /C:830004.exe
                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:2056
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                                                                                                                                            TIMEOUT /T 1 /NOBREAK
                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:3592
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                                                                                                                                                                                                              TASKLIST
                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                              • Enumerates processes with tasklist
                                                                                                                                                                                                                                                                                                                                                                              PID:3664
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\findstr.exe
                                                                                                                                                                                                                                                                                                                                                                              FINDSTR /B /L /I /C:830004.exe
                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:2272
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                                                                                                                                                TIMEOUT /T 1 /NOBREAK
                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:856
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                                                                                                                                                                                                                  TASKLIST
                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Enumerates processes with tasklist
                                                                                                                                                                                                                                                                                                                                                                                  PID:3540
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\findstr.exe
                                                                                                                                                                                                                                                                                                                                                                                  FINDSTR /B /L /I /C:830004.exe
                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:3796
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                                                                                                                                                    TIMEOUT /T 1 /NOBREAK
                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:4364
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                                                                                                                                                                                                                      TASKLIST
                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:4168
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\findstr.exe
                                                                                                                                                                                                                                                                                                                                                                                        FINDSTR /B /L /I /C:830004.exe
                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:4644
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                                                                                                                                                          TIMEOUT /T 1 /NOBREAK
                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Delays execution with timeout.exe
                                                                                                                                                                                                                                                                                                                                                                                          PID:4704
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                                                                                                                                                                                                                          TASKLIST
                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Enumerates processes with tasklist
                                                                                                                                                                                                                                                                                                                                                                                          PID:2276
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\findstr.exe
                                                                                                                                                                                                                                                                                                                                                                                          FINDSTR /B /L /I /C:830004.exe
                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:4000
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                                                                                                                                                            TIMEOUT /T 1 /NOBREAK
                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                            • Delays execution with timeout.exe
                                                                                                                                                                                                                                                                                                                                                                                            PID:1596
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                                                                                                                                                                                                                            TASKLIST
                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                            • Enumerates processes with tasklist
                                                                                                                                                                                                                                                                                                                                                                                            PID:160
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\findstr.exe
                                                                                                                                                                                                                                                                                                                                                                                            FINDSTR /B /L /I /C:830004.exe
                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:4752
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                                                                                                                                                              TIMEOUT /T 1 /NOBREAK
                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:4976
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                                                                                                                                                                                                                                TASKLIST
                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Enumerates processes with tasklist
                                                                                                                                                                                                                                                                                                                                                                                                PID:204
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\findstr.exe
                                                                                                                                                                                                                                                                                                                                                                                                FINDSTR /B /L /I /C:830004.exe
                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:4068
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                                                                                                                                                                  TIMEOUT /T 1 /NOBREAK
                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:3960
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                                                                                                                                                                                                                                    TASKLIST
                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:2320
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\findstr.exe
                                                                                                                                                                                                                                                                                                                                                                                                      FINDSTR /B /L /I /C:830004.exe
                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:2660
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                                                                                                                                                                        TIMEOUT /T 1 /NOBREAK
                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:1176
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                                                                                                                                                                                                                                          TASKLIST
                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:4184
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\findstr.exe
                                                                                                                                                                                                                                                                                                                                                                                                            FINDSTR /B /L /I /C:830004.exe
                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:4140
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                                                                                                                                                                              TIMEOUT /T 1 /NOBREAK
                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:4756
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                                                                                                                                                                                                                                                TASKLIST
                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2256
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\findstr.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  FINDSTR /B /L /I /C:830004.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3196
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    TIMEOUT /T 1 /NOBREAK
                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5100
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      TASKLIST
                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Enumerates processes with tasklist
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2480
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\findstr.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      FINDSTR /B /L /I /C:830004.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:524
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        TIMEOUT /T 1 /NOBREAK
                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • Delays execution with timeout.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4380
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        TASKLIST
                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • Enumerates processes with tasklist
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2984
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\findstr.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        FINDSTR /B /L /I /C:830004.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4060
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          TIMEOUT /T 1 /NOBREAK
                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • Delays execution with timeout.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:732
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          TASKLIST
                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • Enumerates processes with tasklist
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:540
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\findstr.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          FINDSTR /B /L /I /C:830004.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4980
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            TIMEOUT /T 1 /NOBREAK
                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • Delays execution with timeout.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3444
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            TASKLIST
                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • Enumerates processes with tasklist
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1888
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\findstr.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            FINDSTR /B /L /I /C:830004.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5076
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              TIMEOUT /T 1 /NOBREAK
                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1448
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                TASKLIST
                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2308
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\findstr.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  FINDSTR /B /L /I /C:830004.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3984
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    TIMEOUT /T 1 /NOBREAK
                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1952
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      TASKLIST
                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1344
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\findstr.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        FINDSTR /B /L /I /C:830004.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3860
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          TIMEOUT /T 1 /NOBREAK
                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:368
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\findstr.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            FINDSTR /B /L /I /C:830004.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1396
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              TASKLIST
                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              • Enumerates processes with tasklist
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:616
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              TIMEOUT /T 1 /NOBREAK
                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3952
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\findstr.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                FINDSTR /B /L /I /C:830004.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2780
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  TASKLIST
                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4896
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    TIMEOUT /T 1 /NOBREAK
                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Delays execution with timeout.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:452
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    TASKLIST
                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4156
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\findstr.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      FINDSTR /B /L /I /C:830004.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3120
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        TIMEOUT /T 1 /NOBREAK
                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1048
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          TASKLIST
                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4788
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\findstr.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            FINDSTR /B /L /I /C:830004.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3924
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              TIMEOUT /T 1 /NOBREAK
                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1512
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                TASKLIST
                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4920
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\findstr.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  FINDSTR /B /L /I /C:830004.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4932
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    TIMEOUT /T 1 /NOBREAK
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4972
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      TASKLIST
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Enumerates processes with tasklist
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1668
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\findstr.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      FINDSTR /B /L /I /C:830004.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3760
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        TIMEOUT /T 1 /NOBREAK
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Delays execution with timeout.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4260
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        TASKLIST
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4216
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\findstr.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          FINDSTR /B /L /I /C:830004.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3212
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            TIMEOUT /T 1 /NOBREAK
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2292
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              TASKLIST
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:804
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\findstr.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                FINDSTR /B /L /I /C:830004.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2348
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  TIMEOUT /T 1 /NOBREAK
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3484
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    TASKLIST
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Enumerates processes with tasklist
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4440
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\findstr.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    FINDSTR /B /L /I /C:830004.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4716
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      TIMEOUT /T 1 /NOBREAK
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3832
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        TASKLIST
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1168
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\findstr.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          FINDSTR /B /L /I /C:830004.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2960
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            TIMEOUT /T 1 /NOBREAK
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3828
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              TASKLIST
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Enumerates processes with tasklist
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5024
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\findstr.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              FINDSTR /B /L /I /C:830004.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2392
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                TIMEOUT /T 1 /NOBREAK
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Delays execution with timeout.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1232
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                TASKLIST
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2144
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\findstr.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  FINDSTR /B /L /I /C:830004.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4832
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    TIMEOUT /T 1 /NOBREAK
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3052
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      TASKLIST
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Enumerates processes with tasklist
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1812
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\findstr.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      FINDSTR /B /L /I /C:830004.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3676
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        TIMEOUT /T 1 /NOBREAK
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3592
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          TASKLIST
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Enumerates processes with tasklist
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1868
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\findstr.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          FINDSTR /B /L /I /C:830004.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3500
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            TIMEOUT /T 1 /NOBREAK
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4900
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              TASKLIST
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3696
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\findstr.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                FINDSTR /B /L /I /C:830004.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2680
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  TIMEOUT /T 1 /NOBREAK
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3452
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    TASKLIST
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2812
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\findstr.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      FINDSTR /B /L /I /C:830004.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4720
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        TIMEOUT /T 1 /NOBREAK
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4168
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\findstr.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          FINDSTR /B /L /I /C:830004.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2112
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            TASKLIST
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Enumerates processes with tasklist
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3688
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            TIMEOUT /T 1 /NOBREAK
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4128
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              TASKLIST
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2344
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\findstr.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                FINDSTR /B /L /I /C:830004.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2416
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  TIMEOUT /T 1 /NOBREAK
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4672
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    TASKLIST
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Enumerates processes with tasklist
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4308
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\findstr.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    FINDSTR /B /L /I /C:830004.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5088
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      TIMEOUT /T 1 /NOBREAK
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:204
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        TASKLIST
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4648
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\findstr.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          FINDSTR /B /L /I /C:830004.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4792
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            TIMEOUT /T 1 /NOBREAK
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1624
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              TASKLIST
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:952
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\findstr.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                FINDSTR /B /L /I /C:830004.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1652
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  TIMEOUT /T 1 /NOBREAK
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1176
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\findstr.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    FINDSTR /B /L /I /C:830004.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1472
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      TASKLIST
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Enumerates processes with tasklist
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4696
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      TIMEOUT /T 1 /NOBREAK
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Delays execution with timeout.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4880
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      TASKLIST
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4940
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\findstr.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        FINDSTR /B /L /I /C:830004.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1520
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          TIMEOUT /T 1 /NOBREAK
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Delays execution with timeout.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3124
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          TASKLIST
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Enumerates processes with tasklist
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2788
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\findstr.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          FINDSTR /B /L /I /C:830004.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4252
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            TIMEOUT /T 1 /NOBREAK
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2356
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              TASKLIST
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4952
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\findstr.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                FINDSTR /B /L /I /C:830004.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3680
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  TIMEOUT /T 1 /NOBREAK
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:788
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    TASKLIST
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Enumerates processes with tasklist
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4560
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\findstr.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    FINDSTR /B /L /I /C:830004.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4060
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      TIMEOUT /T 1 /NOBREAK
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Delays execution with timeout.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:376
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      TASKLIST
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1172
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\findstr.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        FINDSTR /B /L /I /C:830004.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2756
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          TIMEOUT /T 1 /NOBREAK
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3248
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            TASKLIST
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1640
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\findstr.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              FINDSTR /B /L /I /C:830004.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4712
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                TIMEOUT /T 1 /NOBREAK
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4320
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  TASKLIST
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4208
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\findstr.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    FINDSTR /B /L /I /C:830004.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2436
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      TIMEOUT /T 1 /NOBREAK
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Delays execution with timeout.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4888
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      TASKLIST
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Enumerates processes with tasklist
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3976
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\findstr.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      FINDSTR /B /L /I /C:830004.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1356
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        TIMEOUT /T 1 /NOBREAK
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4064
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          TASKLIST
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Enumerates processes with tasklist
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3712
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\findstr.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          FINDSTR /B /L /I /C:830004.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:368
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            TIMEOUT /T 1 /NOBREAK
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2676
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\tasklist.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              TASKLIST
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:692
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\findstr.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                FINDSTR /B /L /I /C:830004.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4304
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  TIMEOUT /T 1 /NOBREAK
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3652
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c net config server /autodisconnect:-1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4780
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\net.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    net config server /autodisconnect:-1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4920
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\net1 config server /autodisconnect:-1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4860
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c reg add hklm\Software\Microsoft\Windows\CurrentVersion\Run /v SecurityUpdate /t REG_EXPAND_SZ /d C:\Users\Admin\AppData\Local\Temp\830004.exe /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4916
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      reg add hklm\Software\Microsoft\Windows\CurrentVersion\Run /v SecurityUpdate /t REG_EXPAND_SZ /d C:\Users\Admin\AppData\Local\Temp\830004.exe /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4896
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    explorer.exe .\readme_for_unlock.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4220
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c vssadmin delete shadows /All /quiet
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4960
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\vssadmin.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          vssadmin delete shadows /All /quiet
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Interacts with shadow copies
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4936
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\2l0A1d3q0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:528
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            TASKKILL /F /IM 830004.exe.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1668
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            TASKKILL /F /IM 830004.exe.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5020
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            TASKKILL /F /IM 830004.exe.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4216
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            TASKKILL /F /IM 830004.exe.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2292
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            TASKKILL /F /IM 830004.exe.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4072
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            TASKKILL /F /IM 830004.exe.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3420
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            TASKKILL /F /IM 830004.exe.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2060
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            TASKKILL /F /IM 830004.exe.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4536
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            TASKKILL /F /IM 830004.exe.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1524
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            TASKKILL /F /IM 830004.exe.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:984
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp\3y2S3a2v1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:632
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Suspicious behavior: AddClipboardFormatListener
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Suspicious behavior: GetForegroundWindowSpam
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1952
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\vssvc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\vssvc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3172

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Network

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          MITRE ATT&CK Matrix ATT&CK v6

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Initial Access

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Execution

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Persistence

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          T1060

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Privilege Escalation

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Defense Evasion

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          File Deletion

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          T1107

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Modify Registry

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          T1112

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Credential Access

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Credentials in Files

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          T1081

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Query Registry

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          T1012

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Peripheral Device Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          T1120

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          System Information Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          T1082

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Process Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          T1057

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Lateral Movement

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Collection

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Data from Local System

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          T1005

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Exfiltration

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Command and Control

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Impact

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Inhibit System Recovery

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          T1490

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Replay Monitor

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Downloads

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\ProgramData\Microsoft\Settings\0t4Q7u1v2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            163B

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3578e838f655c9bd9426651cc13f6a84

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            10b312cca508e1958507cd3f8a6feae72f6a3a3d

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            42f5a94a41364f4ab334ab6bf3638b1861d3a10b7684df6e5968567ca5027bde

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4ccd6320fe0eb7dccd3b322ffbb94b9f718123dec2781f9f9404e3c520628f8f9d544b88189dda079a8f431cebdecc7a3cd94e37d21eb9257fdc65408465a995

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download Submit
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2l0A1d3q0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1.0MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            e82e2537f74219b8ba9b5e58bed573e4

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            59619c7d5f19886ea8b773eb99d6e9cae343e888

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            f24d40d15950b477e349a2c7f454e7991ff0768745267750e586f13dfe59b5a4

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            96885c4e6dff1b484a3060f766dbb8766c7bdacce6b83a4790de5efd903d1c1cbe07d4bb558a1e051b4841a6f7990bc54a7ffcb0275a5008dd22c019e2f03ba9

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download Submit
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\3y2S3a2v1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            56B

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            0d636660b74b7c62348f813f1024e218

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            bf4aab4ee44cf03b862992effd22f55d6326ae9a

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            61b885ca80cabc98a5a70f68889e180748baca9a05679217a981fd8c8942a15a

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            9aeaae6ae045afcf8bd684e6f58995b05d97d85b29c4e6619f137d089809efb6d3336cef8adeaacbc1fd6ef5d7af4b72dddcdcf53b31780efc9895483c32624e

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download Submit
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/8-196-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/116-152-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/228-151-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/376-182-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/680-166-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/992-175-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/1044-147-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/1112-174-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/1116-148-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/1140-149-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/1600-177-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/1652-173-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/1700-145-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/1828-144-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/2100-189-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/2124-150-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/2236-185-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/2336-176-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/2472-188-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/2656-171-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/2676-153-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/2696-178-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/2712-169-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/2896-190-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/2928-191-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/3064-181-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/3292-193-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/3296-140-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/3312-165-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/3396-170-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/3452-160-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/3464-142-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/3568-155-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/3616-134-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/3660-158-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/3692-157-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/3696-161-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/3716-159-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/3796-156-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/3916-167-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/3952-192-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/3964-168-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/3984-186-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/3988-187-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/4156-194-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/4292-154-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/4336-163-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/4464-162-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/4468-179-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/4576-141-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/4588-184-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/4704-164-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/4712-183-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/4716-172-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/4780-133-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/4820-139-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/4840-143-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/4860-138-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/4896-135-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/4916-132-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/4920-136-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/4924-195-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/4996-146-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/5064-180-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download