blackguard | bb645f9db8579e4905de3c73e4e82e2f6b897205cd850fddf89a1147eeeca401

Analysis

max time kernel
4s
max time network
149s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04-03-2024 16:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dxwebsetup.exe
Size

8.0MB
MD5

9e9056c96170bbe10f6bac77e63cb33a
SHA1

fb648b3990b695a0d54f87459a92aa31d8d5da79
SHA256

bb645f9db8579e4905de3c73e4e82e2f6b897205cd850fddf89a1147eeeca401
SHA512

b65d2040728ba6af4458f7bc845eb6692e52e00d780918efab8047b204c87b4328594c4be828b9b4d1b0fa9d62b06231a462448295e78072e65695ee2aca6019
SSDEEP

196608:8AVbV6yBkRlyxZ8C/VZoyjTYmMFxUhkITUYKVz6TIdpRVqY0EZUqj:xVbgyxZ8C/Vcxu1nKVZRVfKi

Score

10^/10

blackguard stealer

Malware Config

Extracted

Family

blackguard

https://api.telegram.org/bot6212779721:AAH2ucrbRMmKbad4xx6D8A7uUPm_fTJwP-Y/sendMessage?chat_id=1859600982

Signatures

BlackGuard
Infostealer first seen in Late 2021.
stealer blackguard

Executes dropped EXE 28 IoCs

pid	Process
2396	VegaStealer_v2.exe
1140	v2.exe
2716	dxwebsetup.exe
2448	dxwebsetup.exe
2748	VegaStealer_v2.exe
2892	dxwebsetup.exe
2888	VegaStealer_v2.exe
984	dxwebsetup.exe
436	VegaStealer_v2.exe
2620	dxwebsetup.exe
1744	VegaStealer_v2.exe
2756	v2.exe
2744	VegaStealer_v2.exe
1340	dxwebsetup.exe
1400	v2.exe
2984	dxwebsetup.exe
2064	VegaStealer_v2.exe
736	v2.exe
2832	dxwebsetup.exe
1984	v2.exe
1708	VegaStealer_v2.exe
2168	v2.exe
1076	VegaStealer_v2.exe
2376	dxwebsetup.exe
2564	v2.exe
2576	dxwebsetup.exe
2800	VegaStealer_v2.exe
2444	VegaStealer_v2.exe

Loads dropped DLL 64 IoCs

pid	Process
1428	dxwebsetup.exe
1428	dxwebsetup.exe
2396	VegaStealer_v2.exe
2396	VegaStealer_v2.exe
2396	VegaStealer_v2.exe
1428	dxwebsetup.exe
2396	VegaStealer_v2.exe
1140	v2.exe
1140	v2.exe
2716	dxwebsetup.exe
2716	dxwebsetup.exe
2716	dxwebsetup.exe
2716	dxwebsetup.exe
2716	dxwebsetup.exe
2716	dxwebsetup.exe
2448	dxwebsetup.exe
2448	dxwebsetup.exe
2448	dxwebsetup.exe
2748	VegaStealer_v2.exe
2748	VegaStealer_v2.exe
2748	VegaStealer_v2.exe
2448	dxwebsetup.exe
2448	dxwebsetup.exe
2448	dxwebsetup.exe
2892	dxwebsetup.exe
2892	dxwebsetup.exe
2892	dxwebsetup.exe
2888	VegaStealer_v2.exe
2888	VegaStealer_v2.exe
2888	VegaStealer_v2.exe
2892	dxwebsetup.exe
2892	dxwebsetup.exe
2892	dxwebsetup.exe
984	dxwebsetup.exe
984	dxwebsetup.exe
984	dxwebsetup.exe
436	VegaStealer_v2.exe
436	VegaStealer_v2.exe
436	VegaStealer_v2.exe
984	dxwebsetup.exe
984	dxwebsetup.exe
984	dxwebsetup.exe
2620	dxwebsetup.exe
2620	dxwebsetup.exe
2620	dxwebsetup.exe
1744	VegaStealer_v2.exe
1744	VegaStealer_v2.exe
1744	VegaStealer_v2.exe
2748	VegaStealer_v2.exe
2756	v2.exe
2756	v2.exe
2620	dxwebsetup.exe
2620	dxwebsetup.exe
2744	VegaStealer_v2.exe
2744	VegaStealer_v2.exe
2744	VegaStealer_v2.exe
2620	dxwebsetup.exe
1340	dxwebsetup.exe
1340	dxwebsetup.exe
1340	dxwebsetup.exe
2888	VegaStealer_v2.exe
1400	v2.exe
1400	v2.exe
1340	dxwebsetup.exe

Looks up external IP address via web service 17 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
23	freegeoip.app
29	freegeoip.app
2	freegeoip.app
8	freegeoip.app
20	freegeoip.app
42	freegeoip.app
14	freegeoip.app
26	freegeoip.app
36	freegeoip.app
31	ip-api.com
33	freegeoip.app
39	freegeoip.app
45	freegeoip.app
3	freegeoip.app
11	freegeoip.app
17	freegeoip.app
6	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Runs ping.exe 1 TTPs 64 IoCs

Remote System Discovery

T1018

pid	Process
4216	PING.EXE
5540	Process not Found
4968	PING.EXE
6124	Process not Found
2456	Process not Found
3184	Process not Found
3456	Process not Found
1640	Process not Found
6108	PING.EXE
3572	PING.EXE
3108	Process not Found
4656	Process not Found
4984	Process not Found
3292	PING.EXE
5568	Process not Found
5612	Process not Found
4852	Process not Found
3292	PING.EXE
1692	Process not Found
3476	PING.EXE
5112	Process not Found
3744	Process not Found
3056	Process not Found
1724	Process not Found
3528	PING.EXE
3096	Process not Found
4812	Process not Found
3288	Process not Found
4084	Process not Found
2508	Process not Found
1628	Process not Found
2880	PING.EXE
4592	PING.EXE
5008	PING.EXE
1968	Process not Found
4180	PING.EXE
5952	Process not Found
2548	Process not Found
4164	PING.EXE
6108	Process not Found
1572	Process not Found
3096	Process not Found
5792	PING.EXE
5372	PING.EXE
1492	Process not Found
2260	Process not Found
4304	Process not Found
3440	PING.EXE
3204	PING.EXE
5088	Process not Found
5632	Process not Found
1736	Process not Found
3996	Process not Found
2788	PING.EXE
3588	Process not Found
3056	Process not Found
5512	Process not Found
584	Process not Found
3760	Process not Found
4568	PING.EXE
836	PING.EXE
5304	PING.EXE
1808	PING.EXE
4356	Process not Found

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1428 wrote to memory of 2396	1428	dxwebsetup.exe	28
PID 1428 wrote to memory of 2396	1428	dxwebsetup.exe	28
PID 1428 wrote to memory of 2396	1428	dxwebsetup.exe	28
PID 1428 wrote to memory of 2396	1428	dxwebsetup.exe	28
PID 1428 wrote to memory of 2396	1428	dxwebsetup.exe	28
PID 1428 wrote to memory of 2396	1428	dxwebsetup.exe	28
PID 1428 wrote to memory of 2396	1428	dxwebsetup.exe	28
PID 2396 wrote to memory of 1140	2396	VegaStealer_v2.exe	30
PID 2396 wrote to memory of 1140	2396	VegaStealer_v2.exe	30
PID 2396 wrote to memory of 1140	2396	VegaStealer_v2.exe	30
PID 2396 wrote to memory of 1140	2396	VegaStealer_v2.exe	30
PID 2396 wrote to memory of 1140	2396	VegaStealer_v2.exe	30
PID 2396 wrote to memory of 1140	2396	VegaStealer_v2.exe	30
PID 2396 wrote to memory of 1140	2396	VegaStealer_v2.exe	30
PID 1428 wrote to memory of 2716	1428	dxwebsetup.exe	29
PID 1428 wrote to memory of 2716	1428	dxwebsetup.exe	29
PID 1428 wrote to memory of 2716	1428	dxwebsetup.exe	29
PID 1428 wrote to memory of 2716	1428	dxwebsetup.exe	29
PID 1428 wrote to memory of 2716	1428	dxwebsetup.exe	29
PID 1428 wrote to memory of 2716	1428	dxwebsetup.exe	29
PID 1428 wrote to memory of 2716	1428	dxwebsetup.exe	29
PID 2716 wrote to memory of 2748	2716	dxwebsetup.exe	31
PID 2716 wrote to memory of 2748	2716	dxwebsetup.exe	31
PID 2716 wrote to memory of 2748	2716	dxwebsetup.exe	31
PID 2716 wrote to memory of 2748	2716	dxwebsetup.exe	31
PID 2716 wrote to memory of 2748	2716	dxwebsetup.exe	31
PID 2716 wrote to memory of 2748	2716	dxwebsetup.exe	31
PID 2716 wrote to memory of 2748	2716	dxwebsetup.exe	31
PID 2716 wrote to memory of 2448	2716	dxwebsetup.exe	484
PID 2716 wrote to memory of 2448	2716	dxwebsetup.exe	484
PID 2716 wrote to memory of 2448	2716	dxwebsetup.exe	484
PID 2716 wrote to memory of 2448	2716	dxwebsetup.exe	484
PID 2716 wrote to memory of 2448	2716	dxwebsetup.exe	484
PID 2716 wrote to memory of 2448	2716	dxwebsetup.exe	484
PID 2716 wrote to memory of 2448	2716	dxwebsetup.exe	484
PID 2448 wrote to memory of 2888	2448	dxwebsetup.exe	33
PID 2448 wrote to memory of 2888	2448	dxwebsetup.exe	33
PID 2448 wrote to memory of 2888	2448	dxwebsetup.exe	33
PID 2448 wrote to memory of 2888	2448	dxwebsetup.exe	33
PID 2448 wrote to memory of 2888	2448	dxwebsetup.exe	33
PID 2448 wrote to memory of 2888	2448	dxwebsetup.exe	33
PID 2448 wrote to memory of 2888	2448	dxwebsetup.exe	33
PID 2448 wrote to memory of 2892	2448	dxwebsetup.exe	34
PID 2448 wrote to memory of 2892	2448	dxwebsetup.exe	34
PID 2448 wrote to memory of 2892	2448	dxwebsetup.exe	34
PID 2448 wrote to memory of 2892	2448	dxwebsetup.exe	34
PID 2448 wrote to memory of 2892	2448	dxwebsetup.exe	34
PID 2448 wrote to memory of 2892	2448	dxwebsetup.exe	34
PID 2448 wrote to memory of 2892	2448	dxwebsetup.exe	34
PID 2892 wrote to memory of 436	2892	dxwebsetup.exe	35
PID 2892 wrote to memory of 436	2892	dxwebsetup.exe	35
PID 2892 wrote to memory of 436	2892	dxwebsetup.exe	35
PID 2892 wrote to memory of 436	2892	dxwebsetup.exe	35
PID 2892 wrote to memory of 436	2892	dxwebsetup.exe	35
PID 2892 wrote to memory of 436	2892	dxwebsetup.exe	35
PID 2892 wrote to memory of 436	2892	dxwebsetup.exe	35
PID 2892 wrote to memory of 984	2892	dxwebsetup.exe	36
PID 2892 wrote to memory of 984	2892	dxwebsetup.exe	36
PID 2892 wrote to memory of 984	2892	dxwebsetup.exe	36
PID 2892 wrote to memory of 984	2892	dxwebsetup.exe	36
PID 2892 wrote to memory of 984	2892	dxwebsetup.exe	36
PID 2892 wrote to memory of 984	2892	dxwebsetup.exe	36
PID 2892 wrote to memory of 984	2892	dxwebsetup.exe	36
PID 984 wrote to memory of 1744	984	dxwebsetup.exe	1185

C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
"C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1428
- C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
  "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2396
- - C:\Users\Admin\AppData\Local\Temp\v2.exe
    "C:\Users\Admin\AppData\Local\Temp\v2.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1140
- C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
  "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2716
- - C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
    "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2748
  - - C:\Users\Admin\AppData\Local\Temp\v2.exe
      "C:\Users\Admin\AppData\Local\Temp\v2.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:2756
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        5⤵
        
        PID:2344
      - C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        6⤵
        
        PID:3300
- - C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
    "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2448
  - - C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
      "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:2888
    - - C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1400
  - - C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
      "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:2892
    - - C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:436
      - C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        6⤵
        Executes dropped EXE
        
        PID:736
    - - C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:984
      - C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1744
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        7⤵
        Executes dropped EXE
        
        PID:1984
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        8⤵
        
        PID:2808
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        9⤵
        
        PID:3316
      - C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2620
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2744
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        8⤵
        Executes dropped EXE
        
        PID:2168
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        9⤵
        
        PID:2628
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        10⤵
        
        PID:3308
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1340
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        8⤵
        Executes dropped EXE
        
        PID:2064
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        9⤵
        Executes dropped EXE
        
        PID:2564
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        8⤵
        Executes dropped EXE
        
        PID:2984
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        9⤵
        Executes dropped EXE
        
        PID:1708
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        10⤵
        
        PID:2776
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        11⤵
        
        PID:1160
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        12⤵
        
        PID:3324
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        9⤵
        Executes dropped EXE
        
        PID:2832
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        10⤵
        Executes dropped EXE
        
        PID:1076
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        11⤵
        
        PID:2248
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        10⤵
        Executes dropped EXE
        
        PID:2376
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        11⤵
        Executes dropped EXE
        
        PID:2800
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        12⤵
        
        PID:1344
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        13⤵
        
        PID:1356
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        14⤵
        
        PID:3284
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        11⤵
        Executes dropped EXE
        
        PID:2576
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        12⤵
        Executes dropped EXE
        
        PID:2444
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        13⤵
        
        PID:2156
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        12⤵
        
        PID:2436
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        13⤵
        
        PID:1768
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        14⤵
        
        PID:2332
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        15⤵
        
        PID:1904
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        16⤵
        
        PID:3348
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        13⤵
        
        PID:2600
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        14⤵
        
        PID:1088
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        15⤵
        
        PID:2788
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        14⤵
        
        PID:748
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        15⤵
        
        PID:2008
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        16⤵
        
        PID:1652
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        15⤵
        
        PID:1976
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        16⤵
        
        PID:1520
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        17⤵
        
        PID:2540
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        16⤵
        
        PID:2236
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        17⤵
        
        PID:2548
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        18⤵
        
        PID:824
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        19⤵
        
        PID:3084
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        20⤵
        
        PID:3372
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        17⤵
        
        PID:2672
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        18⤵
        
        PID:1196
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        19⤵
        
        PID:2816
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        20⤵
        
        PID:2056
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        21⤵
        Runs ping.exe
        
        PID:3292
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        18⤵
        
        PID:2316
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        19⤵
        
        PID:2096
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        20⤵
        
        PID:2588
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        21⤵
        
        PID:2512
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        22⤵
        
        PID:3364
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        19⤵
        
        PID:1240
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        20⤵
        
        PID:1928
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        21⤵
        
        PID:1208
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        22⤵
        
        PID:2492
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        23⤵
        
        PID:3332
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        20⤵
        
        PID:1732
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        21⤵
        
        PID:2844
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        22⤵
        
        PID:2004
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        23⤵
        
        PID:3028
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        24⤵
        
        PID:3340
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        21⤵
        
        PID:2192
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        22⤵
        
        PID:536
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        23⤵
        
        PID:108
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        24⤵
        
        PID:1836
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        25⤵
        
        PID:3448
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        22⤵
        
        PID:1668
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        23⤵
        
        PID:1800
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        24⤵
        
        PID:1512
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        25⤵
        
        PID:3224
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        26⤵
        
        PID:3600
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        23⤵
        
        PID:1488
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        24⤵
        
        PID:1888
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        25⤵
        
        PID:2460
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        26⤵
        
        PID:3196
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        27⤵
        
        PID:3640
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        24⤵
        
        PID:1776
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        25⤵
        
        PID:2640
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        26⤵
        
        PID:3580
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        27⤵
        
        PID:3736
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        28⤵
        
        PID:4000
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        25⤵
        
        PID:1620
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        26⤵
        
        PID:876
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        27⤵
        
        PID:3664
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        28⤵
        
        PID:3780
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        29⤵
        
        PID:3968
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        26⤵
        
        PID:2024
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        27⤵
        
        PID:3380
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        28⤵
        
        PID:3936
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        29⤵
        
        PID:2264
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        30⤵
        Runs ping.exe
        
        PID:2880
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        27⤵
        
        PID:3388
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        28⤵
        
        PID:3688
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        29⤵
        
        PID:2872
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        30⤵
        
        PID:1896
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        31⤵
        
        PID:3408
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        28⤵
        
        PID:3696
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        29⤵
        
        PID:3844
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        30⤵
        
        PID:108
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        31⤵
        
        PID:2552
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        32⤵
        
        PID:2692
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        29⤵
        
        PID:3852
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        30⤵
        
        PID:3984
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        31⤵
        
        PID:1788
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        32⤵
        
        PID:2700
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        33⤵
        Runs ping.exe
        
        PID:3440
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        30⤵
        
        PID:3992
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        31⤵
        
        PID:3140
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        32⤵
        
        PID:1900
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        33⤵
        
        PID:3904
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        34⤵
        
        PID:2028
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        31⤵
        
        PID:1964
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        32⤵
        
        PID:2936
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        33⤵
        
        PID:3916
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        34⤵
        
        PID:3996
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        35⤵
        
        PID:628
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        32⤵
        
        PID:1708
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        33⤵
        
        PID:1324
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        34⤵
        
        PID:2836
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        35⤵
        
        PID:2444
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        36⤵
        
        PID:960
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        33⤵
        
        PID:3076
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        34⤵
        
        PID:3404
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        35⤵
        
        PID:2792
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        36⤵
        
        PID:2928
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        37⤵
        
        PID:1364
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        34⤵
        
        PID:3428
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        35⤵
        
        PID:1748
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        36⤵
        
        PID:1928
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        37⤵
        
        PID:3964
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        38⤵
        
        PID:2112
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        35⤵
        
        PID:1972
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        36⤵
        
        PID:1092
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        37⤵
        
        PID:896
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        38⤵
        
        PID:2000
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        39⤵
        
        PID:2800
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        36⤵
        
        PID:2728
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        37⤵
        
        PID:2184
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        38⤵
        
        PID:1616
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        39⤵
        
        PID:1120
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        40⤵
        
        PID:3180
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        37⤵
        
        PID:3704
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        38⤵
        
        PID:3872
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        39⤵
        
        PID:4052
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        40⤵
        
        PID:3508
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        41⤵
        
        PID:1800
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        38⤵
        
        PID:3528
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        39⤵
        
        PID:2012
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        40⤵
        
        PID:3896
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        41⤵
        
        PID:384
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        42⤵
        
        PID:3548
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        39⤵
        
        PID:3624
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        40⤵
        
        PID:2480
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        41⤵
        
        PID:4084
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        42⤵
        
        PID:1260
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        43⤵
        
        PID:4244
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        40⤵
        
        PID:1656
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        41⤵
        
        PID:1544
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        42⤵
        
        PID:1968
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        43⤵
        
        PID:1724
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        44⤵
        
        PID:4336
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        41⤵
        
        PID:3752
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        42⤵
        
        PID:3360
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        43⤵
        
        PID:4144
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        44⤵
        
        PID:4316
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        45⤵
        
        PID:4552
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        42⤵
        
        PID:1592
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        43⤵
        
        PID:4020
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        44⤵
        
        PID:4252
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        45⤵
        
        PID:4436
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        46⤵
        
        PID:4716
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        43⤵
        
        PID:3556
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        44⤵
        
        PID:3816
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        45⤵
        
        PID:4560
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        46⤵
        
        PID:4696
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        47⤵
        
        PID:4908
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        44⤵
        
        PID:3832
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        45⤵
        
        PID:4164
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        46⤵
        
        PID:4676
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        47⤵
        
        PID:4872
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        48⤵
        
        PID:2536
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        45⤵
        
        PID:4172
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        46⤵
        
        PID:4448
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        47⤵
        
        PID:4960
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        48⤵
        
        PID:4124
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        49⤵
        
        PID:4588
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        46⤵
        
        PID:4456
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        47⤵
        
        PID:4724
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        48⤵
        
        PID:1728
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        49⤵
        
        PID:4376
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        50⤵
        
        PID:4500
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        47⤵
        
        PID:4732
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        48⤵
        
        PID:4848
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        49⤵
        
        PID:4504
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        50⤵
        
        PID:4528
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        51⤵
        
        PID:5064
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        48⤵
        
        PID:4856
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        49⤵
        
        PID:5028
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        50⤵
        
        PID:4896
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        51⤵
        
        PID:3352
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        52⤵
        
        PID:2688
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        49⤵
        
        PID:5036
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        50⤵
        
        PID:3864
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        51⤵
        
        PID:5060
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        52⤵
        
        PID:5568
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        53⤵
        
        PID:5756
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        50⤵
        
        PID:1532
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        51⤵
        
        PID:4408
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        52⤵
        
        PID:4120
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        53⤵
        
        PID:2532
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        54⤵
        
        PID:2360
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        51⤵
        
        PID:4236
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        52⤵
        
        PID:4752
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        53⤵
        
        PID:112
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        54⤵
        
        PID:5476
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        55⤵
        
        PID:4680
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        52⤵
        
        PID:4924
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        53⤵
        
        PID:2704
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        54⤵
        
        PID:3812
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        55⤵
        
        PID:5356
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        56⤵
        
        PID:2524
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        53⤵
        
        PID:4412
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        54⤵
        
        PID:3932
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        55⤵
        
        PID:4972
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        56⤵
        
        PID:5720
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        57⤵
        
        PID:1284
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        54⤵
        
        PID:4460
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        55⤵
        
        PID:4300
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        56⤵
        
        PID:4308
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        57⤵
        
        PID:5196
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        58⤵
        
        PID:2024
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        55⤵
        
        PID:4652
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        56⤵
        
        PID:4664
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        57⤵
        
        PID:4116
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        58⤵
        
        PID:1692
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        59⤵
        
        PID:2732
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        56⤵
        
        PID:4132
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        57⤵
        
        PID:4584
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        58⤵
        
        PID:3924
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        59⤵
        
        PID:5352
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        60⤵
        
        PID:4580
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        57⤵
        
        PID:4948
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        58⤵
        
        PID:5052
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        59⤵
        
        PID:5172
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        60⤵
        
        PID:2468
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        61⤵
        Runs ping.exe
        
        PID:4216
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        58⤵
        
        PID:4736
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        59⤵
        
        PID:5084
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        60⤵
        
        PID:5312
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        61⤵
        
        PID:5480
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        62⤵
        
        PID:1544
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        59⤵
        
        PID:4612
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        60⤵
        
        PID:3288
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        61⤵
        
        PID:5512
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        62⤵
        
        PID:5664
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        63⤵
        
        PID:3664
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        60⤵
        
        PID:2164
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        61⤵
        
        PID:5220
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        62⤵
        
        PID:5692
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        63⤵
        
        PID:4136
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        64⤵
        
        PID:4912
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        61⤵
        
        PID:5228
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        62⤵
        
        PID:5432
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        63⤵
        
        PID:6028
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        64⤵
        
        PID:5680
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        65⤵
        
        PID:2012
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        62⤵
        
        PID:5440
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        63⤵
        
        PID:5600
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        64⤵
        
        PID:6100
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        65⤵
        
        PID:5668
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        66⤵
        
        PID:3984
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        63⤵
        
        PID:5608
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        64⤵
        
        PID:5892
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        65⤵
        
        PID:5040
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        66⤵
        
        PID:5396
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        67⤵
        
        PID:2868
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        64⤵
        
        PID:5980
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        65⤵
        
        PID:6140
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        66⤵
        
        PID:5364
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        67⤵
        
        PID:5448
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        68⤵
        
        PID:1948
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        65⤵
        
        PID:4852
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        66⤵
        
        PID:3400
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        67⤵
        
        PID:5884
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        68⤵
        
        PID:672
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        69⤵
        
        PID:1968
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        66⤵
        
        PID:4200
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        67⤵
        
        PID:5404
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        68⤵
        
        PID:6048
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        69⤵
        
        PID:980
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        70⤵
        
        PID:3872
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        67⤵
        
        PID:5428
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        68⤵
        
        PID:5548
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        69⤵
        
        PID:5236
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        70⤵
        
        PID:1240
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        71⤵
        
        PID:1104
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        68⤵
        
        PID:5584
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        69⤵
        
        PID:5100
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        70⤵
        
        PID:1916
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        71⤵
        
        PID:5796
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        72⤵
        
        PID:2936
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        69⤵
        
        PID:5832
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        70⤵
        
        PID:5188
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        71⤵
        
        PID:4508
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        70⤵
        
        PID:6072
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        71⤵
        
        PID:1076
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        72⤵
        
        PID:2676
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        73⤵
        
        PID:300
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        74⤵
        
        PID:2316
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        71⤵
        
        PID:3620
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        72⤵
        
        PID:840
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        73⤵
        
        PID:2520
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        72⤵
        
        PID:3636
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        73⤵
        
        PID:1944
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        74⤵
        
        PID:4560
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        75⤵
        
        PID:3224
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        76⤵
        
        PID:5872
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        73⤵
        
        PID:2680
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        74⤵
        
        PID:3108
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        75⤵
        
        PID:5744
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        76⤵
        
        PID:5268
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        77⤵
        
        PID:564
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        74⤵
        
        PID:4628
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        75⤵
        
        PID:4484
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        76⤵
        
        PID:4392
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        77⤵
        
        PID:1704
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        78⤵
        
        PID:5596
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        75⤵
        
        PID:4956
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        76⤵
        
        PID:4756
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        77⤵
        
        PID:2492
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        78⤵
        
        PID:1052
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        79⤵
        
        PID:5592
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        76⤵
        
        PID:2928
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        77⤵
        
        PID:5108
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        78⤵
        
        PID:1460
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        79⤵
        
        PID:5428
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        80⤵
        
        PID:4964
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        77⤵
        
        PID:4904
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        78⤵
        
        PID:5820
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        79⤵
        
        PID:2992
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        80⤵
        
        PID:2228
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        81⤵
        
        PID:5760
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        78⤵
        
        PID:3964
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        79⤵
        
        PID:3828
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        80⤵
        
        PID:4600
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        81⤵
        
        PID:5312
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        82⤵
        
        PID:4400
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        79⤵
        
        PID:5072
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        80⤵
        
        PID:2044
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        81⤵
        
        PID:3448
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        82⤵
        
        PID:3924
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        83⤵
        
        PID:528
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        80⤵
        
        PID:4428
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        81⤵
        
        PID:4180
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        82⤵
        
        PID:268
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        83⤵
        
        PID:2428
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        84⤵
        Runs ping.exe
        
        PID:4592
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        81⤵
        
        PID:4896
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        82⤵
        
        PID:4620
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        83⤵
        
        PID:2260
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        84⤵
        
        PID:4876
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        85⤵
        
        PID:3508
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        82⤵
        
        PID:5916
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        83⤵
        
        PID:2348
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        84⤵
        
        PID:5144
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        85⤵
        
        PID:2504
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        86⤵
        
        PID:4116
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        83⤵
        
        PID:1752
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        84⤵
        
        PID:1744
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        85⤵
        
        PID:3212
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        86⤵
        
        PID:5412
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        87⤵
        
        PID:5308
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        84⤵
        
        PID:2752
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        85⤵
        
        PID:2448
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        86⤵
        
        PID:4268
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        87⤵
        
        PID:5208
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        88⤵
        
        PID:5864
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        85⤵
        
        PID:4672
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        86⤵
        
        PID:3868
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        87⤵
        
        PID:5960
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        88⤵
        
        PID:5996
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        89⤵
        
        PID:4260
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        86⤵
        
        PID:3640
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        87⤵
        
        PID:5252
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        88⤵
        
        PID:1284
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        89⤵
        
        PID:3528
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        90⤵
        
        PID:1412
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        87⤵
        
        PID:4728
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        88⤵
        
        PID:4812
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        89⤵
        
        PID:2496
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        90⤵
        
        PID:4172
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        91⤵
        
        PID:5664
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        88⤵
        
        PID:6136
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        89⤵
        
        PID:5128
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        90⤵
        
        PID:524
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        91⤵
        
        PID:1616
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        92⤵
        
        PID:2940
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        89⤵
        
        PID:5172
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        90⤵
        
        PID:5244
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        91⤵
        
        PID:4232
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        92⤵
        
        PID:4880
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        93⤵
        
        PID:4256
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        90⤵
        
        PID:1172
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        91⤵
        
        PID:5272
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        92⤵
        
        PID:4144
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        93⤵
        
        PID:4652
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        94⤵
        
        PID:4848
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        91⤵
        
        PID:5464
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        92⤵
        
        PID:4036
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        93⤵
        
        PID:5388
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        94⤵
        
        PID:4636
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        95⤵
        
        PID:3180
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        92⤵
        
        PID:5564
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        93⤵
        
        PID:4656
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        94⤵
        
        PID:5156
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        95⤵
        
        PID:5788
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        96⤵
        
        PID:5852
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        93⤵
        
        PID:2408
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        94⤵
        
        PID:3596
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        95⤵
        
        PID:980
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        96⤵
        
        PID:3080
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        97⤵
        Runs ping.exe
        
        PID:3292
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        94⤵
        
        PID:4612
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        95⤵
        
        PID:5980
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        96⤵
        
        PID:4196
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        97⤵
        
        PID:1120
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        98⤵
        
        PID:2324
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        95⤵
        
        PID:5892
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        96⤵
        
        PID:3280
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        97⤵
        
        PID:5024
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        98⤵
        
        PID:5020
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        99⤵
        
        PID:3224
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        96⤵
        
        PID:2588
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        97⤵
        
        PID:2012
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        98⤵
        
        PID:4272
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        99⤵
        
        PID:2056
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        100⤵
        
        PID:1572
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        97⤵
        
        PID:3464
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        98⤵
        
        PID:4312
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        99⤵
        
        PID:3920
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        100⤵
        
        PID:5912
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        101⤵
        Runs ping.exe
        
        PID:4568
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        98⤵
        
        PID:2944
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        99⤵
        
        PID:5424
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        100⤵
        
        PID:3676
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        101⤵
        
        PID:5092
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        102⤵
        
        PID:4916
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        99⤵
        
        PID:3964
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        100⤵
        
        PID:3824
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        101⤵
        
        PID:5692
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        102⤵
        
        PID:2736
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        103⤵
        
        PID:1344
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        100⤵
        
        PID:5704
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        101⤵
        
        PID:5700
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        102⤵
        
        PID:3416
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        103⤵
        
        PID:3420
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        104⤵
        
        PID:3652
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        101⤵
        
        PID:5124
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        102⤵
        
        PID:5060
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        103⤵
        
        PID:4500
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        104⤵
        
        PID:1488
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        105⤵
        
        PID:3680
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        102⤵
        
        PID:3376
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        103⤵
        
        PID:4320
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        104⤵
        
        PID:4856
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        105⤵
        
        PID:5232
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        106⤵
        
        PID:2800
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        103⤵
        
        PID:4316
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        104⤵
        
        PID:2528
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        105⤵
        
        PID:1260
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        106⤵
        
        PID:1836
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        107⤵
        
        PID:3960
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        104⤵
        
        PID:3712
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        105⤵
        
        PID:5968
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        106⤵
        
        PID:6016
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        107⤵
        
        PID:2620
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        108⤵
        
        PID:2072
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        105⤵
        
        PID:3684
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        106⤵
        
        PID:2672
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        107⤵
        
        PID:5964
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        108⤵
        
        PID:4424
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        109⤵
        
        PID:5624
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        106⤵
        
        PID:5644
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        107⤵
        
        PID:1988
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        108⤵
        
        PID:1692
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        109⤵
        
        PID:5048
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        110⤵
        
        PID:1732
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        107⤵
        
        PID:3532
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        108⤵
        
        PID:4400
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        109⤵
        
        PID:5360
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        110⤵
        
        PID:2532
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        111⤵
        
        PID:5396
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        108⤵
        
        PID:5312
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        109⤵
        
        PID:5204
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        110⤵
        
        PID:3360
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        111⤵
        
        PID:384
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        112⤵
        
        PID:3468
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        109⤵
        
        PID:2204
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        110⤵
        
        PID:4104
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        111⤵
        
        PID:4884
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        112⤵
        
        PID:996
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        113⤵
        
        PID:1160
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        110⤵
        
        PID:5008
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        111⤵
        
        PID:1608
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        112⤵
        
        PID:1904
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        113⤵
        
        PID:2460
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        114⤵
        Runs ping.exe
        
        PID:4164
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        111⤵
        
        PID:2868
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        112⤵
        
        PID:5556
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        113⤵
        
        PID:4632
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        114⤵
        
        PID:5848
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        115⤵
        Runs ping.exe
        
        PID:836
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        112⤵
        
        PID:5720
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        113⤵
        
        PID:896
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        114⤵
        
        PID:2508
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        115⤵
        
        PID:2468
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        116⤵
        Runs ping.exe
        
        PID:5304
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        113⤵
        
        PID:2024
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        114⤵
        
        PID:4036
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        115⤵
        
        PID:3296
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        116⤵
        
        PID:4504
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        117⤵
        Runs ping.exe
        
        PID:3528
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        114⤵
        
        PID:5400
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        115⤵
        
        PID:3088
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        116⤵
        
        PID:3352
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        117⤵
        
        PID:1824
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        118⤵
        
        PID:5476
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        115⤵
        
        PID:5224
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        116⤵
        
        PID:3872
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        117⤵
        
        PID:2140
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        118⤵
        
        PID:3096
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        119⤵
        
        PID:1616
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        116⤵
        
        PID:3016
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        117⤵
        
        PID:1956
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        118⤵
        
        PID:1368
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        119⤵
        
        PID:6060
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        120⤵
        
        PID:1912
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        117⤵
        
        PID:5044
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        118⤵
        
        PID:4044
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        119⤵
        
        PID:2912
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        120⤵
        
        PID:4272
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        121⤵
        
        PID:3244
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        118⤵
        
        PID:4492
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        119⤵
        
        PID:4560
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        120⤵
        
        PID:2184
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        121⤵
        
        PID:5216
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        122⤵
        
        PID:4960
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        119⤵
        
        PID:2028
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        120⤵
        
        PID:2928
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        121⤵
        
        PID:5328
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        122⤵
        
        PID:3824
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        123⤵
        
        PID:4680
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        120⤵
        
        PID:2904
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        121⤵
        
        PID:5072
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        122⤵
        
        PID:3440
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        123⤵
        
        PID:5064
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        124⤵
        
        PID:3444
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        121⤵
        
        PID:2864
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        122⤵
        
        PID:3412
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        123⤵
        
        PID:2980
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        124⤵
        
        PID:4316
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        125⤵
        
        PID:3956
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        122⤵
        
        PID:1560
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        123⤵
        
        PID:5804
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        124⤵
        
        PID:3560
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        125⤵
        
        PID:1352
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        126⤵
        
        PID:4996
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        123⤵
        
        PID:5576
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        124⤵
        
        PID:2748
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        125⤵
        
        PID:4396
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        126⤵
        
        PID:3316
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        127⤵
        
        PID:2132
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        124⤵
        
        PID:3936
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        125⤵
        
        PID:3036
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        126⤵
        
        PID:2740
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        127⤵
        
        PID:2444
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        128⤵
        
        PID:1896
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        125⤵
        
        PID:4888
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        126⤵
        
        PID:4536
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        127⤵
        
        PID:3620
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        128⤵
        
        PID:5160
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        129⤵
        Runs ping.exe
        
        PID:6108
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        126⤵
        
        PID:2736
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        127⤵
        
        PID:3852
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        128⤵
        
        PID:2076
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        129⤵
        
        PID:1636
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        130⤵
        Runs ping.exe
        
        PID:5008
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        127⤵
        
        PID:748
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        128⤵
        
        PID:4672
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        129⤵
        
        PID:4800
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        130⤵
        
        PID:1488
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        131⤵
        
        PID:4852
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        128⤵
        
        PID:2564
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        129⤵
        
        PID:4820
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        130⤵
        
        PID:5200
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        131⤵
        
        PID:4020
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        132⤵
        
        PID:1968
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        129⤵
        
        PID:3800
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        130⤵
        
        PID:4576
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        131⤵
        
        PID:4028
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        132⤵
        
        PID:2396
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        133⤵
        
        PID:5336
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        130⤵
        
        PID:584
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        131⤵
        
        PID:4972
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        132⤵
        
        PID:5896
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        133⤵
        
        PID:5888
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        134⤵
        
        PID:4516
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        131⤵
        
        PID:3388
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        132⤵
        
        PID:1520
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        133⤵
        
        PID:1376
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        134⤵
        
        PID:2732
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        135⤵
        
        PID:5412
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        132⤵
        
        PID:4384
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        133⤵
        
        PID:2664
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        134⤵
        
        PID:5984
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        135⤵
        
        PID:2936
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        136⤵
        
        PID:5140
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        133⤵
        
        PID:2480
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        134⤵
        
        PID:3152
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        135⤵
        
        PID:3916
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        136⤵
        
        PID:3480
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        137⤵
        
        PID:6024
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        134⤵
        
        PID:2408
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        135⤵
        
        PID:4712
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        136⤵
        
        PID:2188
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        137⤵
        
        PID:4720
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        138⤵
        
        PID:1924
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        135⤵
        
        PID:3184
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        136⤵
        
        PID:1364
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        137⤵
        
        PID:2632
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        136⤵
        
        PID:3112
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        137⤵
        
        PID:6068
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        138⤵
        
        PID:2624
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        139⤵
        
        PID:5832
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        140⤵
        Runs ping.exe
        
        PID:3204
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        137⤵
        
        PID:3600
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        138⤵
        
        PID:4284
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        139⤵
        
        PID:2112
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        140⤵
        
        PID:4236
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        141⤵
        
        PID:5612
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        138⤵
        
        PID:4688
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        139⤵
        
        PID:1748
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        140⤵
        
        PID:344
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        141⤵
        
        PID:3108
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        142⤵
        
        PID:3724
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        139⤵
        
        PID:4652
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        140⤵
        
        PID:980
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        141⤵
        
        PID:3096
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        142⤵
        
        PID:5724
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        143⤵
        Runs ping.exe
        
        PID:3572
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        140⤵
        
        PID:5228
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        141⤵
        
        PID:4504
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        142⤵
        
        PID:5580
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        143⤵
        
        PID:4304
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        144⤵
        
        PID:2736
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        141⤵
        
        PID:3392
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        142⤵
        
        PID:5024
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        143⤵
        
        PID:5696
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        144⤵
        
        PID:5604
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        145⤵
        
        PID:1556
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        142⤵
        
        PID:3052
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        143⤵
        
        PID:2696
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        144⤵
        
        PID:4068
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        145⤵
        
        PID:1812
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        146⤵
        Runs ping.exe
        
        PID:4180
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        143⤵
        
        PID:5704
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        144⤵
        
        PID:5712
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        145⤵
        
        PID:2540
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        146⤵
        
        PID:1948
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        147⤵
        
        PID:5464
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        144⤵
        
        PID:5876
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        145⤵
        
        PID:1772
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        146⤵
        
        PID:5408
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        147⤵
        
        PID:5512
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        148⤵
        
        PID:4264
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        145⤵
        
        PID:3996
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        146⤵
        
        PID:4360
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        147⤵
        
        PID:2204
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        148⤵
        
        PID:5460
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        149⤵
        
        PID:4076
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        146⤵
        
        PID:2844
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        147⤵
        
        PID:2156
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        148⤵
        
        PID:1684
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        149⤵
        
        PID:4356
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        150⤵
        
        PID:1340
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        147⤵
        
        PID:2248
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        148⤵
        
        PID:4588
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        149⤵
        
        PID:3320
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        150⤵
        
        PID:2480
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        151⤵
        
        PID:3900
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        148⤵
        
        PID:5516
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        149⤵
        
        PID:1588
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        150⤵
        
        PID:5720
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        151⤵
        
        PID:2408
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        152⤵
        
        PID:2948
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        149⤵
        
        PID:4372
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        150⤵
        
        PID:5768
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        151⤵
        
        PID:5132
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        152⤵
        
        PID:5816
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        153⤵
        
        PID:2588
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        150⤵
        
        PID:1708
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        151⤵
        
        PID:4100
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        152⤵
        
        PID:3384
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        153⤵
        
        PID:2688
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        154⤵
        
        PID:4928
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        151⤵
        
        PID:3908
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        152⤵
        
        PID:3484
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        153⤵
        
        PID:5136
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        154⤵
        
        PID:3088
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        155⤵
        
        PID:5432
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        152⤵
        
        PID:2024
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        153⤵
        
        PID:2524
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        154⤵
        
        PID:3916
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        155⤵
        
        PID:3252
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        156⤵
        
        PID:2196
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        153⤵
        
        PID:3928
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        154⤵
        
        PID:3152
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        155⤵
        
        PID:5048
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        156⤵
        
        PID:3228
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        157⤵
        Runs ping.exe
        
        PID:4968
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        154⤵
        
        PID:4660
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        155⤵
        
        PID:4884
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        156⤵
        
        PID:2512
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        157⤵
        
        PID:1436
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        158⤵
        
        PID:5316
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        155⤵
        
        PID:1376
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        156⤵
        
        PID:5244
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        157⤵
        
        PID:1824
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        158⤵
        
        PID:4640
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        159⤵
        
        PID:2624
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        156⤵
        
        PID:2872
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        157⤵
        
        PID:4908
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        158⤵
        
        PID:5032
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        159⤵
        
        PID:3076
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        160⤵
        
        PID:5824
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        157⤵
        
        PID:3904
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        158⤵
        
        PID:3784
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        159⤵
        
        PID:1560
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        160⤵
        
        PID:3128
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        161⤵
        
        PID:5812
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        158⤵
        
        PID:3436
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        159⤵
        
        PID:2908
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        160⤵
        
        PID:5324
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        159⤵
        
        PID:5800
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        160⤵
        
        PID:2896
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        161⤵
        
        PID:5876
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        162⤵
        
        PID:2844
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        163⤵
        
        PID:5604
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        160⤵
        
        PID:1060
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        161⤵
        
        PID:2344
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        162⤵
        
        PID:5000
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        163⤵
        
        PID:6124
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        164⤵
        Runs ping.exe
        
        PID:5792
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        161⤵
        
        PID:824
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        162⤵
        
        PID:1652
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        163⤵
        
        PID:4260
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        164⤵
        
        PID:6116
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        165⤵
        
        PID:5596
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        162⤵
        
        PID:3964
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        163⤵
        
        PID:3292
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        164⤵
        
        PID:4836
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        165⤵
        
        PID:3852
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        166⤵
        
        PID:984
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        163⤵
        
        PID:1900
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        164⤵
        
        PID:4140
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        165⤵
        
        PID:4304
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        166⤵
        
        PID:1188
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        167⤵
        
        PID:4396
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        164⤵
        
        PID:4600
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        165⤵
        
        PID:556
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        166⤵
        
        PID:2384
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        167⤵
        
        PID:5972
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        168⤵
        
        PID:5232
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        165⤵
        
        PID:3772
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        166⤵
        
        PID:5424
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        167⤵
        
        PID:2040
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        168⤵
        
        PID:4192
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        169⤵
        
        PID:1684
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        166⤵
        
        PID:2484
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        167⤵
        
        PID:5788
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        168⤵
        
        PID:3416
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        169⤵
        
        PID:3192
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        170⤵
        
        PID:3708
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        167⤵
        
        PID:3532
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        168⤵
        
        PID:5004
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        169⤵
        
        PID:1988
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        170⤵
        
        PID:2920
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        171⤵
        
        PID:4852
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        168⤵
        
        PID:5160
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        169⤵
        
        PID:6108
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        170⤵
        
        PID:3584
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        171⤵
        
        PID:868
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        172⤵
        
        PID:5304
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        169⤵
        
        PID:2792
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        170⤵
        
        PID:4592
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        171⤵
        
        PID:4100
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        172⤵
        
        PID:4036
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        173⤵
        
        PID:3016
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        170⤵
        
        PID:1812
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        171⤵
        
        PID:5200
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        172⤵
        
        PID:2508
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        173⤵
        
        PID:2640
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        174⤵
        
        PID:2664
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        171⤵
        
        PID:4900
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        172⤵
        
        PID:3972
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        173⤵
        
        PID:4628
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        174⤵
        
        PID:4912
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        175⤵
        
        PID:6040
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        172⤵
        
        PID:4220
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        173⤵
        
        PID:3496
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        174⤵
        
        PID:3872
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        175⤵
        
        PID:2504
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        176⤵
        
        PID:5524
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        173⤵
        
        PID:4976
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        174⤵
        
        PID:4116
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        175⤵
        
        PID:4172
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        176⤵
        
        PID:5016
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        177⤵
        
        PID:2820
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        174⤵
        
        PID:4516
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        175⤵
        
        PID:896
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        176⤵
        
        PID:4128
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        177⤵
        
        PID:5208
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        178⤵
        
        PID:580
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        175⤵
        
        PID:5620
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        176⤵
        
        PID:6000
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        177⤵
        
        PID:5884
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        178⤵
        
        PID:4984
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        179⤵
        
        PID:3120
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        176⤵
        
        PID:4284
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        177⤵
        
        PID:3904
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        178⤵
        
        PID:3628
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        179⤵
        
        PID:2168
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        180⤵
        
        PID:5064
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        177⤵
        
        PID:1944
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        178⤵
        
        PID:1068
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        179⤵
        
        PID:1492
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        180⤵
        
        PID:4832
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        181⤵
        Runs ping.exe
        
        PID:1808
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        178⤵
        
        PID:3400
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        179⤵
        
        PID:1060
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        180⤵
        
        PID:4716
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        179⤵
        
        PID:3392
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        180⤵
        
        PID:5632
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        181⤵
        
        PID:5188
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        182⤵
        
        PID:5756
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        183⤵
        Runs ping.exe
        
        PID:5372
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        180⤵
        
        PID:3408
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        181⤵
        
        PID:4960
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        182⤵
        
        PID:4536
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        183⤵
        
        PID:4528
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        184⤵
        
        PID:5692
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        181⤵
        
        PID:5588
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        182⤵
        
        PID:3760
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        183⤵
        
        PID:4796
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        184⤵
        
        PID:4008
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        185⤵
        
        PID:2868
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        182⤵
        
        PID:4596
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        183⤵
        
        PID:5940
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        184⤵
        
        PID:4352
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        185⤵
        
        PID:5792
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        186⤵
        
        PID:3924
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        183⤵
        
        PID:2060
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        184⤵
        
        PID:3936
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        185⤵
        
        PID:2596
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        186⤵
        
        PID:3416
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        187⤵
        
        PID:5172
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        184⤵
        
        PID:3812
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        185⤵
        
        PID:5968
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        186⤵
        
        PID:1740
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        187⤵
        
        PID:3028
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        188⤵
        
        PID:5896
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        185⤵
        
        PID:5416
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        186⤵
        
        PID:3640
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        187⤵
        
        PID:5556
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        188⤵
        
        PID:4664
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        189⤵
        
        PID:4584
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        186⤵
        
        PID:4260
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        187⤵
        
        PID:5804
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        188⤵
        
        PID:4052
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        189⤵
        
        PID:6140
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        190⤵
        
        PID:5284
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        187⤵
        
        PID:5456
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        188⤵
        
        PID:2204
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        189⤵
        
        PID:2252
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        190⤵
        
        PID:5808
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        191⤵
        
        PID:2524
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        188⤵
        
        PID:6128
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        189⤵
        
        PID:3908
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        190⤵
        
        PID:2088
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        191⤵
        
        PID:5880
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        192⤵
        
        PID:3432
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        189⤵
        
        PID:1812
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        190⤵
        
        PID:2436
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        191⤵
        
        PID:572
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        192⤵
        
        PID:3700
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        193⤵
        
        PID:484
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        190⤵
        
        PID:5600
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        191⤵
        
        PID:3576
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        192⤵
        
        PID:3664
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        193⤵
        
        PID:4884
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        194⤵
        
        PID:4652
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        191⤵
        
        PID:2496
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        192⤵
        
        PID:4240
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        193⤵
        
        PID:4780
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        194⤵
        
        PID:2440
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        195⤵
        
        PID:5360
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        192⤵
        
        PID:672
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        193⤵
        
        PID:1544
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        194⤵
        
        PID:4132
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        195⤵
        
        PID:2012
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        196⤵
        
        PID:5420
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        193⤵
        
        PID:636
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        194⤵
        
        PID:3928
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        195⤵
        
        PID:3252
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        196⤵
        
        PID:3752
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        197⤵
        
        PID:5936
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        194⤵
        
        PID:4692
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        195⤵
        
        PID:1728
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        196⤵
        
        PID:4560
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        197⤵
        
        PID:4156
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        198⤵
        Runs ping.exe
        
        PID:3476
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        195⤵
        
        PID:5388
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        196⤵
        
        PID:2708
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        197⤵
        
        PID:1068
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        198⤵
        
        PID:4392
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        199⤵
        Runs ping.exe
        
        PID:2788
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        196⤵
        
        PID:896
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        197⤵
        
        PID:5980
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        198⤵
        
        PID:3376
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        199⤵
        
        PID:2308
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        200⤵
        
        PID:3608
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        197⤵
        
        PID:3132
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        198⤵
        
        PID:3460
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        199⤵
        
        PID:2908
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        200⤵
        
        PID:2388
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        201⤵
        
        PID:2528
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        198⤵
        
        PID:1912
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        199⤵
        
        PID:5700
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        200⤵
        
        PID:2516
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        201⤵
        
        PID:6100
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        202⤵
        
        PID:1744
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        199⤵
        
        PID:5056
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        200⤵
        
        PID:1580
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        201⤵
        
        PID:4080
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        202⤵
        
        PID:1140
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        203⤵
        
        PID:2696
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        200⤵
        
        PID:1060
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        201⤵
        
        PID:1492
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        202⤵
        
        PID:1652
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        203⤵
        
        PID:2828
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        204⤵
        
        PID:1884
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        201⤵
        
        PID:580
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        202⤵
        
        PID:1784
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        203⤵
        
        PID:4428
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        204⤵
        
        PID:4316
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        205⤵
        
        PID:2284
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        202⤵
        
        PID:5484
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        203⤵
        
        PID:1220
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        204⤵
        
        PID:5868
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        205⤵
        
        PID:3220
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        206⤵
        
        PID:5564
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        203⤵
        
        PID:2004
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        204⤵
        
        PID:4440
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        205⤵
        
        PID:1976
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        206⤵
        
        PID:2996
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        207⤵
        
        PID:5340
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        204⤵
        
        PID:4836
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        205⤵
        
        PID:4260
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        206⤵
        
        PID:108
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        207⤵
        
        PID:3160
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        208⤵
        
        PID:1708
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        205⤵
        
        PID:2484
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        206⤵
        
        PID:3680
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        207⤵
        
        PID:2032
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        208⤵
        
        PID:3708
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        209⤵
        
        PID:2100
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        206⤵
        
        PID:3552
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        207⤵
        
        PID:3984
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        208⤵
        
        PID:1776
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        209⤵
        
        PID:5556
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        210⤵
        
        PID:4100
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        207⤵
        
        PID:1216
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        208⤵
        
        PID:5040
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        209⤵
        
        PID:1928
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        208⤵
        
        PID:3100
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        209⤵
        
        PID:3596
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        210⤵
        
        PID:2824
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        211⤵
        
        PID:4424
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        212⤵
        
        PID:4280
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        209⤵
        
        PID:3856
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        210⤵
        
        PID:2888
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        211⤵
        
        PID:2664
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        210⤵
        
        PID:5164
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        211⤵
        
        PID:4592
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        212⤵
        
        PID:4216
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        213⤵
        
        PID:2584
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        214⤵
        
        PID:1924
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        211⤵
        
        PID:5308
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        212⤵
        
        PID:5452
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        213⤵
        
        PID:4376
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        212⤵
        
        PID:5408
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        213⤵
        
        PID:1944
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        213⤵
        
        PID:2456

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\.bat

Filesize
168B

MD5
b171e3bdfe3db3cdb6d3396477038d75

SHA1
358d668569db1ff82aeaaf9f5f06bc988fd8c670

SHA256
c55f25edd2b0843c5a1bfc4c6be8a0a75f78fb466f98281af66320a3a2136da3

SHA512
f98d916810d0554023f0ed8a5961e2d222ec4c3d71de243ec984ce228778c92b94a2f05e602b60635f7b5b42e307d3f5816c26cd4c440f3652ceec958dcdd5a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\4a710197-6547-4b3f-b54c-2c0b4d7d5d19

Filesize
46KB

MD5
02d2c46697e3714e49f46b680b9a6b83

SHA1
84f98b56d49f01e9b6b76a4e21accf64fd319140

SHA256
522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9

SHA512
60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

Download Submit
C:\Users\Admin\AppData\Local\Temp\7a5ce918-a77f-4c32-a43e-4ed45656bc57

Filesize
20KB

MD5
c9ff7748d8fcef4cf84a5501e996a641

SHA1
02867e5010f62f97ebb0cfb32cb3ede9449fe0c9

SHA256
4d3f3194cb1133437aa69bb880c8cbb55ddf06ff61a88ca6c3f1bbfbfd35d988

SHA512
d36054499869a8f56ac8547ccd5455f1252c24e17d2b185955390b32da7e2a732ace4e0f30f9493fcc61425a2e31ed623465f998f41af69423ee0e3ed1483a73

Download Submit
C:\Users\Admin\AppData\Local\Temp\BouncyCastle.Crypto.dll

Filesize
3.2MB

MD5
0cf454b6ed4d9e46bc40306421e4b800

SHA1
9611aa929d35cbd86b87e40b628f60d5177d2411

SHA256
e51721dc0647f4838b1abc592bd95fd8cb924716e8a64f83d4b947821fa1fa42

SHA512
85262f1bc67a89911640f59a759b476b30ca644bd1a1d9cd3213cc8aae16d7cc6ea689815f19b146db1d26f7a75772ceb48e71e27940e3686a83eb2cf7e46048

Download Submit
C:\Users\Admin\AppData\Local\Temp\BouncyCastle.Crypto.dll

Filesize
42KB

MD5
cd2f3c904743186d0b26f5cb8dcbd3cf

SHA1
8ae411600ef173d728df5585b13076ebf539fec0

SHA256
41c362e8460d831e9756fe8a79f413c4773437309fceb566346f85b2707bb6ed

SHA512
30030e34fa0e349558f010b8dcc141df3cdabf80b78a512fef1ca7144cc9f23cd8cc845e80c4374d7a27b424e8c237fc395c5aef8cdc4688dd5f435a7ff8d8c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\BouncyCastle.Crypto.dll

Filesize
192KB

MD5
59c421962565976c1fdbc58d524cd30d

SHA1
68b04bc8424a73443926b90c8a86979b66fb1747

SHA256
d02802aa4d91978e320514bfaa3b9ce4acc12da48569458c8e3a489059226c6e

SHA512
cf6e967674997e71934a2b11de0be0e433ab27070227b5310ce257a74277d6916b97eafae8d45ac6915ca3a1d3de17a424e454b89cd5a12b2e12a93110cc73a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\EntityFramework.SqlServer.dll

Filesize
572KB

MD5
f32ce9a5a866313d1a3391aa42153f4a

SHA1
7404383a681a2ec1c5bf24152fa298e934f53783

SHA256
4583f9d1e62c90e3bc41d9feacca8152e3bb067b767e806872772ea9a55803e9

SHA512
a276ed47e0687699e844dfb8215b4ef922eb6b853d7ca4bbf707b4439c26f8afc6886f00af0b3ba76e2dd322a0870594d81bcdc2095656a2e5b78568dc5f3f51

Download Submit
C:\Users\Admin\AppData\Local\Temp\EntityFramework.dll

Filesize
64KB

MD5
5100e52becb8ee005c93f0761411d700

SHA1
174ab25d327bbfd1c03d5da4d37dd613399e4448

SHA256
6b3b4bc0cb3ee7716785849afc150f12e6b3c32bd89f621ddcf8e67056fe9bc3

SHA512
4dc1c2205b03d1d0bb99f4152019a1dae9c6692a5e93c0c352750b6966bcab3aaab115ffc1a6f72762d1c4fc7d5f69c2a3e4230ed1790f9b04cc2f103dc304f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\EntityFramework.dll

Filesize
4.6MB

MD5
00d48a062ef3dffba05159d019cf427d

SHA1
4ba6db0470c776423d73438894207b1d6f1e7b5d

SHA256
7e60999a5741b9b041d3a8d9bad1c952e4cce8216142327ab413b1ddca70a4c5

SHA512
14b4f20f87b72c8bb0f129fdfa1b865dbc63e49b6ff763d29516ad7b235288fb959bd35609baa3fd80e07be4fbeb120eaae475b7628a85d6cbc0110a442d39ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\Newtonsoft.Json.dll

Filesize
19KB

MD5
2cf361f0cdba955d74efa2fbaf3b003b

SHA1
c4dc0196ce68d2675861c62cbafb4c6b10e0a7ba

SHA256
c0d7a431fe298177be82a74bbfd784e8bf746dff32961cddcdb3cc21bfb96ee0

SHA512
3c06c323a461178e0e01a911ed19733e1beaab5492fe8947c32a09fa0f264f538e2cc9ad9e1f89e77957e37169d3643feae87096bf7499d6f6430d0cc1eb825d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Newtonsoft.Json.dll

Filesize
571KB

MD5
169b6d383b7c650ab3ae2129397a6cf3

SHA1
fcaef7defb04301fd55fb1421bb15ef96d7040d6

SHA256
b896083feb2bdedc1568b62805dbd354c55e57f2d2469a52aec6c98f4ec2dedf

SHA512
7a7a7bdb508b8bf177249251c83b65a2ef4a5d8b29397cab130cb8444b23888678673a9a2e4b1c74cc095b358f923b9e7e5a91bfa8c240412d95765851f1dd87

Download Submit
C:\Users\Admin\AppData\Local\Temp\SQLite.Interop.dll

Filesize
1.4MB

MD5
3bef9d115e134e3a3f2b244076c4c03c

SHA1
92b1601b46edb88f0974e9463adac333d1713169

SHA256
a06942dd73d6d1fa59f62860ed989f552d01f5b0f6f4926a41a8a4c951940760

SHA512
66925b9c05654cea2552902e9604e6b8c53e5535286f792a4d8780e7cc1fd1ac61ca19466e6644b280c9eff311007b89d706cc92ecdedd78ff372382d7719e28

Download Submit
C:\Users\Admin\AppData\Local\Temp\SQLite.Interop.dll

Filesize
1.4MB

MD5
2b84c092a7db3d276e12900d740d69a9

SHA1
4f513bb08bc76c5395a18e5266f916242019ac13

SHA256
8207181409f99b37be79c178d83988cf5ae2d13de9c7eb40939263fa69e207ca

SHA512
229873dd05aafff0d42426cd99d4738b99aa52c1c91de8cb71cf5b1f80ff8e4d0d4898307e31864a20ac88c55642965397c85ed98070ece02d486d532a1fa643

Download Submit
C:\Users\Admin\AppData\Local\Temp\System.Data.SQLite.EF6.dll

Filesize
203KB

MD5
162e50541954d792420156956b09d410

SHA1
f10943992ead2dd222df7ccfc76d74d495ef086d

SHA256
20d7e37fedce140669e2a2d89f4e7a67405134ca1876a55f9cf9ab0eae8f206e

SHA512
a86167344c9645387b6b0c95ab19f2adfee5573ab2c6068e38e3de0b94990379a948f0e10214b6f7dcf1f5e3159032217113267b8a7b4365f19ba970a8a51bf9

Download Submit
C:\Users\Admin\AppData\Local\Temp\System.Data.SQLite.Linq.dll

Filesize
203KB

MD5
355bbea5ee15d806e0d6bd6dbd25f494

SHA1
b41ebf0ff5c4effa1fd123845efe03764e91341e

SHA256
8e2ae9d4a03e95c714d7835310795b7e0434b8aa3448e6a5b106ad9dbba0158f

SHA512
ad453a26a22efb522126208a1e7ebee6ec429fde52f4a3d30212ef9f58e39714fd7f42d05031bf31992199aea573f9f1887dc83ed30093527d3e8b33476a4387

Download Submit
C:\Users\Admin\AppData\Local\Temp\System.Data.SQLite.dll

Filesize
410KB

MD5
056d3fcaf3b1d32ff25f513621e2a372

SHA1
851740bca46bab71d0b1d47e47f3eb8358cbee03

SHA256
66b64362664030bff1596cda2ec5bd5df48cc7c8313c32f771db4aa30a3f86f9

SHA512
ce47c581538f48a46d70279a62c702195beacbfafb48a5a862b3922625fe56f6887d1679c6d9366f946d3d2124cb31c2a3eacbbd14d601ea56e66575cdf46180

Download Submit
C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe

Filesize
1.3MB

MD5
3aeba6519cf3d456327f93375e913d08

SHA1
c3b6c2e45fd12486dad991f0625e02768edf70cf

SHA256
d68b2440eaee2f643f8861224ede875f26a4125679903d1a1f7931a3363961c3

SHA512
f4bd678fc6513ef63f15e0b51aba1185c5c0b8b49a6ef3f59142154957eafd3f754e1340ef5f331a122f68b98b33747e6fa6eb9139b0b673542f8428f593c248

Download Submit
C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe

Filesize
8.0MB

MD5
9e9056c96170bbe10f6bac77e63cb33a

SHA1
fb648b3990b695a0d54f87459a92aa31d8d5da79

SHA256
bb645f9db8579e4905de3c73e4e82e2f6b897205cd850fddf89a1147eeeca401

SHA512
b65d2040728ba6af4458f7bc845eb6692e52e00d780918efab8047b204c87b4328594c4be828b9b4d1b0fa9d62b06231a462448295e78072e65695ee2aca6019

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp1BEA.tmp.tmpdb

Filesize
5.0MB

MD5
a53853573e9a383aa8a028b59a189d7e

SHA1
1e26bae50634b0fed0cc7fd6082bdbe7cdb04414

SHA256
d2cc9ce0fb6ff073c493fcd32e7384c303604a419bb92db15cf5362c39e9a029

SHA512
a2a770f37d44839b024e8b40630627edc4763db7f6bd145431b55283ec328613bae699f8ca3ef11b4bc47e061025f2223dfc0b94d66268d1c32c711c17208079

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp1BEB.tmp.tmpdb

Filesize
96KB

MD5
d367ddfda80fdcf578726bc3b0bc3e3c

SHA1
23fcd5e4e0e5e296bee7e5224a8404ecd92cf671

SHA256
0b8607fdf72f3e651a2a8b0ac7be171b4cb44909d76bb8d6c47393b8ea3d84a0

SHA512
40e9239e3f084b4b981431817ca282feb986cf49227911bf3d68845baf2ee626b564c8fabe6e13b97e6eb214da1c02ca09a62bcf5e837900160cf479c104bf77

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp1E1E.tmp.dat

Filesize
92KB

MD5
cecd507c6f492a99481169aee2953402

SHA1
92eb8f999e617fe6389d446f86c13da4345a3591

SHA256
861e59e3dd349b246bbdbfb17b8771899df01feb9439e60e3f38cf5c221cfeda

SHA512
e8a2bdfa874c0141e41766dd416675c931ac17e05cd8afaa4b729e9e2deef317aa8a1a848976fcedae4ab39c7b88db42c1205a7572b283fd4f97068bd5ec424c

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp1EFB.tmp.dat

Filesize
148KB

MD5
90a1d4b55edf36fa8b4cc6974ed7d4c4

SHA1
aba1b8d0e05421e7df5982899f626211c3c4b5c1

SHA256
7cf3e9e8619904e72ea6608cc43e9b6c9f8aa2af02476f60c2b3daf33075981c

SHA512
ea0838be754e1258c230111900c5937d2b0788f90bbf7c5f82b2ceda7868e50afb86c301f313267eaa912778da45755560b5434885521bf915967a7863922ae2

Download Submit
C:\Users\Admin\AppData\Local\Temp\v2.exe

Filesize
271KB

MD5
836107386d4a2c6a84c945496556118b

SHA1
5677a4455f5697dba4e9e17a48ca0f02985455f9

SHA256
62b92015e99f9162a9a6a11edcf136ab43d30fbd82cbc47b0f40630daad8e028

SHA512
19a7efe2348366042463ad93d556d66aa24506a5df661e11f503ea07d736a34416fe8f7354f21b78c49d1a6915a6fced2b9856e0493240968bbe5effa1337c87

Download Submit
C:\Users\Admin\AppData\Roaming\BVDRFBwXuDVDLwVXDyTFTDVVIKJSPGIM.Admin\Process.txt

Filesize
756B

MD5
75f6ba9a5bc00527aba6d5f68854dbd8

SHA1
a0066537b0a76e64b8abc921c3777035c620aa17

SHA256
7649dc5aef95235cd902f653b540ff152f2df9346fef27d0c9069ed65033903f

SHA512
b93ff96c14ba7293a68a5c3ee61fc10750687a4ed968545bdc9de50f16a7c673fe3fff5f31277238a9847ea3cb77d2af7aaef60546e9d0d0e750c23b2ab8b9e9

Download Submit
C:\Users\Admin\AppData\Roaming\BZNDXJRFJDDyuJRPBXyIKJSPGIM.Admin\Process.txt

Filesize
659B

MD5
05f330ee454aeac385326fc86edc6f88

SHA1
3ed24b10eb3364b0fb1dba6e7038c27f3189605e

SHA256
f4775b322473b412da80177d1df48670e8990fb7050108628d0377a3ef70b45f

SHA512
bbdc04f9fa182076455a3c2b1eed6ea61ca9d83bccd0080e161badeb71920699ab698bed2c7c0a278aaf384738781b1084325f7634a9b9655d6b7e478f6fe173

Download Submit
C:\Users\Admin\AppData\Roaming\IKJSPGIM.Admin\Process.txt

Filesize
632B

MD5
c5898d3494c4e62ca4d38222f6d80884

SHA1
4f3f4c3979f9b898e39729fc75bea8cde3527965

SHA256
afaf9d21b2591c4bdaa3f208634a0fe81d3b11b7495839db2049d1a687e16c04

SHA512
05bd4e17940b45e091528aaa91a4ce92177b6a7cd903d2d82515c3a99a371cadffe53ecfa0cf8e76f903a833eafe49e0aecf0049dd8b3ab19770891a385a3d85

Download Submit
C:\Users\Admin\AppData\Roaming\JyDDNZyDJDXVZyJNBIKJSPGIM.Admin\Process.txt

Filesize
664B

MD5
561f43dcb9ae1e11d9714231f6575e83

SHA1
d8eaec28c0efad112d0db4c52a4834f24acf985c

SHA256
a1def3a28f16def19d9c98798d2e82da4be41b5221c7605497d08f5b41e7dc87

SHA512
3fc32450295ddf248135c5742c822784eb8c37020f9b8d6d679ddef5df07e243b16f5b5ffdcea5a4592b3de1ee3ebca8d217cb2bcff687bcceea8d8460124df0

Download Submit
C:\Users\Admin\AppData\Roaming\LBIKJSPGIM.Admin\Browsers\Firefox\Bookmarks.txt

Filesize
105B

MD5
2e9d094dda5cdc3ce6519f75943a4ff4

SHA1
5d989b4ac8b699781681fe75ed9ef98191a5096c

SHA256
c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142

SHA512
d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7

Download Submit
C:\Users\Admin\AppData\Roaming\LBIKJSPGIM.Admin\Process.txt

Filesize
584B

MD5
517e74eb52d88abec579ad266fccaa89

SHA1
f165702bdd090474bf9807f87cdf55d76ac4ba8d

SHA256
1c069fbb1aa9dc2c24bf9e807166814ce434f003587db6bd76ff3b869b9f4a5b

SHA512
9349e30efb77fa15b50493a02f4849cc3cfa1e9b08bf40dd3763e7b8706c2a50349fef81a919617626dd579c202480853b685b425e82a67da65d09cb27ccd04a

Download Submit
C:\Users\Admin\AppData\Roaming\LPuwyVwPPPNVJHFIKJSPGIM.Admin\Files\CloseRename.txt

Filesize
1.0MB

MD5
81c773e0249e54fa3a4b82480ad25225

SHA1
621bd7e14013086c9ae8d2c3f31eb5f96e7f5411

SHA256
f20cb58782a052eebc3ce22c2ee1614eafac0233ec2b15890ed08821df58db8b

SHA512
04df5f5c14c19b93e77aa91ea822f8685ba10c3ac7832e2f2115fef6bbf1c881e1010522cb947c79f633646b53e42d78035e019d258442c718b37395497a4210

Download Submit
C:\Users\Admin\AppData\Roaming\LPuwyVwPPPNVJHFIKJSPGIM.Admin\Files\ReadDisable.txt

Filesize
899KB

MD5
aa7d52170dc89c99f507a8de2181f826

SHA1
cb4aabfd25bc86f8001d6e59ef46c69c184d5aa2

SHA256
5c4fb430a84267c3d7cde93ee549ed3e87224ce537525e4f9c7b25437eb0673c

SHA512
60904d769904073f9d15dbe18d4be47ccfc313a608638e744423cd789404065a4d6927bd5225dd827bc05ac8cc98893d40e2c7713a8bf17b2a5bcabb1aed34dc

Download Submit
C:\Users\Admin\AppData\Roaming\LPuwyVwPPPNVJHFIKJSPGIM.Admin\Process.txt

Filesize
590B

MD5
2356c4554942b4ce777bee6d122816c5

SHA1
a4ea32f97d23dfac465c4efabc841a2a21aad150

SHA256
690f9e7c7bdc9adc4f3ce1ad02d618aae52bf54d8c4bd67e209c28657185a2ef

SHA512
7ebb5f00d8519205530c4e97857acfaed155ad19dcaebb4f8db6b095771300fdae4e73d1b3fb60acbcbcd531e661e52b3ab12e0c6e306c43d4c7faa937005bfd

Download Submit
C:\Users\Admin\AppData\Roaming\LPuwyVwPPPNVJHFIKJSPGIM.Admin\Screen.png

Filesize
381KB

MD5
2cf6b1073e01ccc0b1581662ef2dc02f

SHA1
f0e57fafd0ee70636e2cc58fbb23965a5ecfb30d

SHA256
472fb1fcf3ba82edda59f562e03bcd6149f16a1eb35f65a517639289f4098e95

SHA512
d60cbd7ee5f5373249d78a863bf4f21e0fca36f2ae18bd21651ffd14212d2d54a3b7dd9219bdcd8afd76441d0d4eaf69c9988a6c508a2da039da9a77558b6f5a

Download Submit
C:\Users\Admin\AppData\Roaming\NJyDLFNTTXJBuRuZRHRBPNVBIKJSPGIM.Admin\Process.txt

Filesize
633B

MD5
336703fb450a91db47f90bcc4084f765

SHA1
10f53180e51c86ca0f962423898b1bb9cc2bc48d

SHA256
af156a146961a8b96e23278ae5344a214b8aa6b601eb973b096d010c898e9dae

SHA512
936ce898fd1e080f2319f6dd148d1db455d51d2ad1f7934ae588e09935ded9620febe5aa20a2d2695543dae4f87150123431052e6ea30e95fdae5d3c09c9d7de

Download Submit
C:\Users\Admin\AppData\Roaming\NVwBDBuwuuFRwZIKJSPGIM.Admin\Process.txt

Filesize
607B

MD5
38c2ad37c94f888fb231a78488c86372

SHA1
028bd44dfe50b95af79e4b7644831d039eac4183

SHA256
00c57ed9645c2189a6a10404f1d6e7fec47c6ad4f0cb93c4c20b4b408d3aad11

SHA512
a4244345f643c40a30f5e4d96994605d794751152228995811e44d02bfc5da5483e313cc8ee76d8f5f93ef65d28b4337a9e9951158005ce4615e6ed406412ea3

Download Submit
C:\Users\Admin\AppData\Roaming\PPHIKJSPGIM.Admin\Process.txt

Filesize
618B

MD5
214bd7684e9d6a6c48a825d8a36eb8df

SHA1
3be548d07809fe12c658d8a118abeb6f345cf690

SHA256
2da2cef451b5047ee2452e68e70b1684cfcac156b270a0928d9331d9360204e9

SHA512
1794696a25cc0a663358d9a91ced9d212a89cc47b1164688da8613fa07743544e7f4d128259bbd018a6471604d5ce719ac7f1513742a872f068a0c3c87088a91

Download Submit
C:\Users\Admin\AppData\Roaming\PwyyRuRuZRPZBwLIKJSPGIM.Admin\Process.txt

Filesize
610B

MD5
e9718b89d9c46462f83de2a135198acb

SHA1
7c2f17dbb75d6f1a1eb277ad91d6e959f2f234d3

SHA256
01a02561aa77791a8024c9fc3cebb06879bbecce3ba74dfc7b347de14d01e79d

SHA512
2c778cc40e848ec96f5e80b88244106b80071c1e51c44aaeb50d18c77b307e43bf593b4757c9e4e90168f7f2b5f86048c6b0166f49be723a59801799090e1b78

Download Submit
C:\Users\Admin\AppData\Roaming\RLVFIKJSPGIM.Admin\Process.txt

Filesize
585B

MD5
61b5d36a15ba5746d73e39751c1f6e2a

SHA1
d9790072208db3042e7fb968ad56cac32bef7214

SHA256
8fa82620b5e06be16a620c5f0ad263ac4f6eab86650cfa4d766cbf749c1cac91

SHA512
71267f0ccda7e6f3ba99d21816f2dbb146d85c94b12f61e680f540cbb888110c549e15aaef352511592789e140c5af40e45ae42d98e111c1952c8ef3df4dbf8c

Download Submit
C:\Users\Admin\AppData\Roaming\VPNVyXyIKJSPGIM.Admin\Process.txt

Filesize
593B

MD5
5f8c91f0482639a2fbe4cd463b85ad8e

SHA1
d70e72ea094b7c9a36657dfddc606967756c1ca7

SHA256
87782e42a346371983cbe5f40f39fcf928304f49cee204500223d545f4c5e6e8

SHA512
e9bca5caeee46058b56d1c65d706b44a18134e50549a9f14674f50aa726ccbcf76020af2ca69d7d653a26d08e150b116cdd1f961496c124ce653b03f13b649f8

Download Submit
C:\Users\Admin\AppData\Roaming\XuJyHNuFDVNFFIKJSPGIM.Admin\Process.txt

Filesize
563B

MD5
2373fdbc3bc84125d8f8e94fdcfc35e7

SHA1
5c2815cd40837b446215f4540adac0dde4f49fb1

SHA256
0760df24a33ce2b4d8f3886d91eb69cc83200b61f6c3479a46f519d3d56987e0

SHA512
cda4c26c8c6c45185f955d5ac62924064430e4fccc1bced4c824bc1907daf67f9c1a807e58a575fb054c85dc1b1e1180a5661808ab13c8e89addc42f3fb7eb1b

Download Submit
C:\Users\Admin\AppData\Roaming\uDRLwLLwTVwBBFZZIKJSPGIM.Admin\Process.txt

Filesize
667B

MD5
6facc389b3b5d1ed1d1aeff173e86dda

SHA1
5637f3de34fca56e2a834c6e5a5dc6a68e55ceb7

SHA256
88f3d53dc280b011baaaac968795f9856852f16a0467847147b2e7e15a85e15c

SHA512
f5af1942f6836fd0590b0d6e48333dd7fac19959458d00575b2a4fcd17b1770daa442b58fbdc7d67f4321454df4e6d51084362d6d97317b9de792be149ad617a

Download Submit
\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe

Filesize
1.4MB

MD5
e3698d40e2671b475c21bf0d458f868e

SHA1
99abb979b52aa62b8bbdf80001fdcf1bf3bc0d9c

SHA256
e787aceb086f38b0a8eaa3b0533e1d01f7bfecb14a899f24f40c7a85cca9d5de

SHA512
6408036527d67106326a4b1b8411c8ab54e936a3f6063157a4462559d9912da078a77a40c09ea8c635f4b5d5a69728c903deb43429b2f2a0ff33743ac72fb275

Download Submit
\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe

Filesize
7.7MB

MD5
32b53fb7ea1ae556aabf2ae6080b36df

SHA1
e4e050a1ab40d3cba3922dae5fd494e0e56e7d2f

SHA256
0707fa0e3fe56c7d63adfb54b50a4f8601477131ec9104aa33a45b69950753db

SHA512
9d968fa0bafe95f9eb4ec37ae83718da22c99380932ad5453e4275385da3099405955e919d8391ef5671445b670c68e7a0cdcef5fb239cc5fbe378267f5d27de

Download Submit
\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe

Filesize
3.9MB

MD5
770a357638203bdfa2e7a1404ec2f9ea

SHA1
a635ef50925bc165cc49b95f9694cded6806c5a8

SHA256
48f6dfab826be016854ed882b4205a5618347aa51ef7ea6bd0a51e21aed510f0

SHA512
1e78d3720121e217f09a4458724ed36acd6d57109f92abef993d845b0d047c7219dc5195983a7eb307d1e55f536803d3f536373cf0a65eaf4fb903b4b1582634

Download Submit
\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe

Filesize
1.6MB

MD5
ff1b84f835aac4712a29f891e44e272d

SHA1
8c6fbdcfba2f4a5e3a8597a2438b020bbff6b93d

SHA256
ab00207460c2f887bee88f95de5d0b486094a55b837d8e437019605d7153d301

SHA512
3ff5d3adc90d98ca2567080da22b0829846717ed767b8dd08e84895862fb1dae88bd496de6e60b87af20765fa1d58785236c4ffe6c6174a20b0ea4212065745c

Download Submit
\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe

Filesize
384KB

MD5
717de13d0bee9b7faaf7251055ef8a02

SHA1
3c312b2a076b67695dbfa08a535c0efea5a83756

SHA256
116d4b710081e776e655f131d1d41e60b73d42c766dd015db3aadcdc08f0bf93

SHA512
b22a2419b626de0d39faf08c8bb1f5521b9e0eb2e02d27577cdf13e6feb052418a69ee05fe2ebcbf75818ade3b1005b9169b76f72f8f68977850528a02f8e74e

Download Submit
\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe

Filesize
19KB

MD5
d31127ce4b4349971a09fadcb48bfc2e

SHA1
8c345a5e9744e492dd2daf18efd9c218a724028e

SHA256
d256411b206a15eca28d057a041992ce887906e88e7a36150c4080a6ab21a037

SHA512
7c4bbd57b3476d0b41bf167d36c2fe42d006ae8f888b40e62bc545c4beeeef619c6016ae509c9ffe0a72d28d050c5ec65529828d9bcbab5ec339f099ba99619f

Download Submit
\Users\Admin\AppData\Local\Temp\dxwebsetup.exe

Filesize
19KB

MD5
69c273de58fb1e057b4bf307136021ac

SHA1
85a62aaee30d83ee6389678f2568a31792cbd8ef

SHA256
a35d948d65a495f5db371a111777f974a4cb425c5f901a72e8438a91a800849b

SHA512
22c013abc5d46cc1e96a2fe68889b2de85cb7325140934fc8060196f57c1d6fd20088a36ba765b91df1d1d60c607f269d3b1ebad0450fbe777f5f0d268fea921

Download Submit
\Users\Admin\AppData\Local\Temp\dxwebsetup.exe

Filesize
512KB

MD5
43e3a4f3085789f3c8b82db39e47fc96

SHA1
ee8e875f7f5a168c4bd6fe6e60696b8ec106b85b

SHA256
f915f8c9e703acd894f1a2bb240ff6bd9aea9357ccfdd9da8bfe8b3184cd5bd2

SHA512
b729400f17d10a730241c672516f9d160051ed0c10e67d60dcf3e1fd775684d428a59c6592537b2e08066570c25f5c5dd99a644d1fb1684f4736244093935d5f

Download Submit
\Users\Admin\AppData\Local\Temp\dxwebsetup.exe

Filesize
640KB

MD5
bd9e95120c1ce485b3f8dd1d05effcb1

SHA1
f1f64fe4060c7da228bda5669641a2c41b921564

SHA256
4f698e3afe279ac4410d26d060ed60c7604c66d54a99b208129afb14d0f4281f

SHA512
049f1672615f6a350afce906310a9599d6dca065572bf74f0139974999ba9466b1205721434ba9bc77aa3bb8b28fe73b195d2a64a2f5202bfd452cc959f1aeb8

Download Submit
memory/108-3667-0x0000000000E60000-0x0000000000EAA000-memory.dmp

Filesize
296KB

Download
memory/900-5951-0x0000000000F00000-0x0000000000F4A000-memory.dmp

Filesize
296KB

Download
memory/900-6008-0x0000000004D40000-0x0000000004DD2000-memory.dmp

Filesize
584KB

Download
memory/900-6022-0x0000000004C70000-0x0000000004CD8000-memory.dmp

Filesize
416KB

Download
memory/900-6035-0x00000000007D0000-0x00000000007F0000-memory.dmp

Filesize
128KB

Download
memory/1100-6798-0x0000000001090000-0x00000000010DA000-memory.dmp

Filesize
296KB

Download
memory/1140-244-0x0000000000CB0000-0x0000000000CFA000-memory.dmp

Filesize
296KB

Download
memory/1220-4677-0x0000000000F00000-0x0000000000F4A000-memory.dmp

Filesize
296KB

Download
memory/1772-4331-0x0000000000730000-0x0000000000750000-memory.dmp

Filesize
128KB

Download
memory/1772-4325-0x0000000002540000-0x00000000025A8000-memory.dmp

Filesize
416KB

Download
memory/1772-4282-0x0000000004E30000-0x0000000004EC2000-memory.dmp

Filesize
584KB

Download
memory/1776-3714-0x00000000003D0000-0x000000000041A000-memory.dmp

Filesize
296KB

Download
memory/1988-3006-0x0000000000080000-0x00000000000CA000-memory.dmp

Filesize
296KB

Download
memory/2416-9687-0x0000000001220000-0x00000000012B2000-memory.dmp

Filesize
584KB

Download
memory/2416-9731-0x0000000004720000-0x0000000004788000-memory.dmp

Filesize
416KB

Download
memory/2416-9758-0x00000000006E0000-0x0000000000700000-memory.dmp

Filesize
128KB

Download
memory/2420-9074-0x0000000000BF0000-0x0000000000C58000-memory.dmp

Filesize
416KB

Download
memory/2420-9065-0x0000000004EE0000-0x0000000004F72000-memory.dmp

Filesize
584KB

Download
memory/2520-1543-0x00000000048F0000-0x0000000004958000-memory.dmp

Filesize
416KB

Download
memory/2520-1622-0x00000000007E0000-0x0000000000800000-memory.dmp

Filesize
128KB

Download
memory/2520-1492-0x0000000000290000-0x00000000002DA000-memory.dmp

Filesize
296KB

Download
memory/2520-1503-0x0000000005BD0000-0x0000000005C62000-memory.dmp

Filesize
584KB

Download
memory/2632-7531-0x0000000000790000-0x00000000007B0000-memory.dmp

Filesize
128KB

Download
memory/2632-7526-0x0000000004E90000-0x0000000004EF8000-memory.dmp

Filesize
416KB

Download
memory/2632-2422-0x0000000004CB0000-0x0000000004D18000-memory.dmp

Filesize
416KB

Download
memory/2632-2407-0x00000000058D0000-0x0000000005962000-memory.dmp

Filesize
584KB

Download
memory/2632-7506-0x0000000004D80000-0x0000000004E12000-memory.dmp

Filesize
584KB

Download
memory/2652-8519-0x00000000010E0000-0x0000000001148000-memory.dmp

Filesize
416KB

Download
memory/2664-3787-0x0000000002590000-0x0000000002622000-memory.dmp

Filesize
584KB

Download
memory/2664-3772-0x0000000000F00000-0x0000000000F4A000-memory.dmp

Filesize
296KB

Download
memory/2664-3817-0x0000000005240000-0x00000000052A8000-memory.dmp

Filesize
416KB

Download
memory/2676-1473-0x0000000000290000-0x00000000002DA000-memory.dmp

Filesize
296KB

Download
memory/2856-4613-0x0000000000290000-0x0000000000298000-memory.dmp

Filesize
32KB

Download
memory/3140-6894-0x00000000009A0000-0x00000000009C0000-memory.dmp

Filesize
128KB

Download
memory/3140-6887-0x00000000008A0000-0x0000000000908000-memory.dmp

Filesize
416KB

Download
memory/3140-6847-0x0000000005140000-0x00000000051D2000-memory.dmp

Filesize
584KB

Download
memory/4360-5025-0x0000000000A20000-0x0000000000A88000-memory.dmp

Filesize
416KB

Download
memory/4360-5014-0x00000000055B0000-0x0000000005642000-memory.dmp

Filesize
584KB

Download
memory/4628-3084-0x00000000001A0000-0x00000000001EA000-memory.dmp

Filesize
296KB

Download
memory/4712-8030-0x0000000000950000-0x0000000000970000-memory.dmp

Filesize
128KB

Download
memory/4712-8008-0x00000000009F0000-0x0000000000A58000-memory.dmp

Filesize
416KB

Download
memory/4712-7962-0x00000000012D0000-0x000000000131A000-memory.dmp

Filesize
296KB

Download
memory/4716-3294-0x00000000050E0000-0x0000000005172000-memory.dmp

Filesize
584KB

Download
memory/4716-3315-0x0000000000630000-0x0000000000650000-memory.dmp

Filesize
128KB

Download
memory/4716-3299-0x00000000058A0000-0x0000000005908000-memory.dmp

Filesize
416KB

Download
memory/4912-5674-0x0000000004F90000-0x0000000004FF8000-memory.dmp

Filesize
416KB

Download
memory/4912-5683-0x0000000000A20000-0x0000000000A40000-memory.dmp

Filesize
128KB

Download
memory/4912-5661-0x00000000048B0000-0x0000000004942000-memory.dmp

Filesize
584KB

Download