blackguard | bb645f9db8579e4905de3c73e4e82e2f6b897205cd850fddf89a1147eeeca401

Analysis

max time kernel
19s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
04-03-2024 16:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dxwebsetup.exe
Size

8.0MB
MD5

9e9056c96170bbe10f6bac77e63cb33a
SHA1

fb648b3990b695a0d54f87459a92aa31d8d5da79
SHA256

bb645f9db8579e4905de3c73e4e82e2f6b897205cd850fddf89a1147eeeca401
SHA512

b65d2040728ba6af4458f7bc845eb6692e52e00d780918efab8047b204c87b4328594c4be828b9b4d1b0fa9d62b06231a462448295e78072e65695ee2aca6019
SSDEEP

196608:8AVbV6yBkRlyxZ8C/VZoyjTYmMFxUhkITUYKVz6TIdpRVqY0EZUqj:xVbgyxZ8C/Vcxu1nKVZRVfKi

Score

10^/10

blackguard stealer

Malware Config

Extracted

Family

blackguard

https://api.telegram.org/bot6212779721:AAH2ucrbRMmKbad4xx6D8A7uUPm_fTJwP-Y/sendMessage?chat_id=1859600982

Signatures

BlackGuard
Infostealer first seen in Late 2021.
stealer blackguard

Checks computer location settings 2 TTPs 5 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	dxwebsetup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	dxwebsetup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	VegaStealer_v2.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	dxwebsetup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	VegaStealer_v2.exe

Executes dropped EXE 7 IoCs

pid	Process
3588	VegaStealer_v2.exe
996	dxwebsetup.exe
5100	VegaStealer_v2.exe
3708	dxwebsetup.exe
348	v2.exe
3672	VegaStealer_v2.exe
4640	dxwebsetup.exe

Looks up external IP address via web service 18 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
95	freegeoip.app
102	freegeoip.app
105	freegeoip.app
52	freegeoip.app
58	freegeoip.app
79	freegeoip.app
92	freegeoip.app
99	freegeoip.app
33	freegeoip.app
65	freegeoip.app
88	freegeoip.app
90	ip-api.com
108	freegeoip.app
45	ip-api.com
61	freegeoip.app
70	freegeoip.app
73	freegeoip.app
76	freegeoip.app

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Runs ping.exe 1 TTPs 64 IoCs

Remote System Discovery

T1018

pid	Process
4712	PING.EXE
4940	PING.EXE
2280	PING.EXE
5024	PING.EXE
3504	PING.EXE
3684	PING.EXE
1476	PING.EXE
5412	PING.EXE
3256	PING.EXE
5408	PING.EXE
3528	PING.EXE
5764	PING.EXE
5992	PING.EXE
5948	PING.EXE
5532	PING.EXE
964	PING.EXE
5408	PING.EXE
2272	PING.EXE
6004	PING.EXE
5500	PING.EXE
2960	PING.EXE
5984	PING.EXE
2432	PING.EXE
2168	PING.EXE
5352	PING.EXE
3584	PING.EXE
5340	PING.EXE
1152	PING.EXE
4984	PING.EXE
3504	PING.EXE
1976	PING.EXE
1260	PING.EXE
5324	PING.EXE
3720	PING.EXE
2824	PING.EXE
1504	PING.EXE
5248	PING.EXE
5996	PING.EXE
5116	PING.EXE
5672	PING.EXE
3476	PING.EXE
5604	PING.EXE
4800	PING.EXE
1260	PING.EXE
5660	PING.EXE
5320	PING.EXE
5548	PING.EXE
4600	PING.EXE
5800	PING.EXE
5672	PING.EXE
5816	PING.EXE
5700	PING.EXE
5024	PING.EXE
5452	PING.EXE
1748	PING.EXE
2224	PING.EXE
2980	PING.EXE
6036	PING.EXE
3140	PING.EXE
6032	PING.EXE
5672	PING.EXE
4640	PING.EXE
6096	PING.EXE
4456	PING.EXE

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2024 wrote to memory of 3588	2024	dxwebsetup.exe	99
PID 2024 wrote to memory of 3588	2024	dxwebsetup.exe	99
PID 2024 wrote to memory of 3588	2024	dxwebsetup.exe	99
PID 2024 wrote to memory of 996	2024	dxwebsetup.exe	228
PID 2024 wrote to memory of 996	2024	dxwebsetup.exe	228
PID 2024 wrote to memory of 996	2024	dxwebsetup.exe	228
PID 996 wrote to memory of 5100	996	dxwebsetup.exe	130
PID 996 wrote to memory of 5100	996	dxwebsetup.exe	130
PID 996 wrote to memory of 5100	996	dxwebsetup.exe	130
PID 996 wrote to memory of 3708	996	dxwebsetup.exe	102
PID 996 wrote to memory of 3708	996	dxwebsetup.exe	102
PID 996 wrote to memory of 3708	996	dxwebsetup.exe	102
PID 3588 wrote to memory of 348	3588	VegaStealer_v2.exe	103
PID 3588 wrote to memory of 348	3588	VegaStealer_v2.exe	103
PID 3588 wrote to memory of 348	3588	VegaStealer_v2.exe	103
PID 3708 wrote to memory of 3672	3708	dxwebsetup.exe	104
PID 3708 wrote to memory of 3672	3708	dxwebsetup.exe	104
PID 3708 wrote to memory of 3672	3708	dxwebsetup.exe	104
PID 3708 wrote to memory of 4640	3708	dxwebsetup.exe	598
PID 3708 wrote to memory of 4640	3708	dxwebsetup.exe	598
PID 3708 wrote to memory of 4640	3708	dxwebsetup.exe	598

C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
"C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2024
- C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
  "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3588
- - C:\Users\Admin\AppData\Local\Temp\v2.exe
    "C:\Users\Admin\AppData\Local\Temp\v2.exe"
    3⤵
    - Executes dropped EXE
    PID:348
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
      4⤵
      PID:3620
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        5⤵
        Runs ping.exe
        
        PID:3684
- C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
  "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:996
- - C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
    "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    PID:5100
  - - C:\Users\Admin\AppData\Local\Temp\v2.exe
      "C:\Users\Admin\AppData\Local\Temp\v2.exe"
      4⤵
      PID:4560
- - C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
    "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3708
  - - C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
      "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
      4⤵
      Executes dropped EXE
      PID:3672
    - - C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        5⤵
        
        PID:4556
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        6⤵
        
        PID:912
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        7⤵
        Runs ping.exe
        
        PID:964
  - - C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
      "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
      4⤵
      Executes dropped EXE
      PID:4640
    - - C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        5⤵
        
        PID:1748
      - C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        6⤵
        
        PID:4484
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        7⤵
        
        PID:2304
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        8⤵
        Runs ping.exe
        
        PID:3584
    - - C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        5⤵
        
        PID:688
      - C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        6⤵
        
        PID:3804
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        7⤵
        
        PID:2908
      - C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        6⤵
        
        PID:5024
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        7⤵
        
        PID:3016
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        8⤵
        
        PID:1512
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        9⤵
        
        PID:4356
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        10⤵
        
        PID:5100
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        10⤵
        Runs ping.exe
        
        PID:1476
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        7⤵
        
        PID:1148
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        8⤵
        
        PID:1028
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        9⤵
        
        PID:4548
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        10⤵
        
        PID:5024
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        11⤵
        
        PID:1080
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        8⤵
        
        PID:4168
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        9⤵
        
        PID:60
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        10⤵
        
        PID:1868
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        11⤵
        
        PID:1976
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        12⤵
        
        PID:4664
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        9⤵
        
        PID:1080
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        10⤵
        
        PID:1388
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        11⤵
        
        PID:1084
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        12⤵
        
        PID:1548
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        13⤵
        Runs ping.exe
        
        PID:1260
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        10⤵
        
        PID:3652
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        11⤵
        
        PID:4372
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        12⤵
        
        PID:1968
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        11⤵
        
        PID:4116
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        12⤵
        
        PID:912
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        13⤵
        
        PID:4408
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        14⤵
        
        PID:4668
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        15⤵
        Runs ping.exe
        
        PID:5024
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        12⤵
        
        PID:4528
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        13⤵
        
        PID:1616
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        14⤵
        
        PID:4820
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        15⤵
        
        PID:2348
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        16⤵
        Runs ping.exe
        
        PID:4456
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        13⤵
        
        PID:1860
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        14⤵
        
        PID:4168
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        15⤵
        
        PID:4504
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        16⤵
        
        PID:4484
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        17⤵
        
        PID:4036
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        14⤵
        
        PID:4456
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        15⤵
        
        PID:64
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        16⤵
        
        PID:1660
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        15⤵
        
        PID:968
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        16⤵
        
        PID:1752
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        17⤵
        
        PID:4020
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        18⤵
        
        PID:1532
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        19⤵
        
        PID:3684
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        16⤵
        
        PID:3148
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        17⤵
        
        PID:3212
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        18⤵
        
        PID:964
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        19⤵
        
        PID:1748
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        20⤵
        Runs ping.exe
        
        PID:5700
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        17⤵
        
        PID:3992
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        18⤵
        
        PID:2800
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        19⤵
        
        PID:5368
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        20⤵
        
        PID:5456
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        21⤵
        
        PID:5836
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        18⤵
        
        PID:4136
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        19⤵
        
        PID:4060
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        20⤵
        
        PID:5520
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        21⤵
        
        PID:5616
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        22⤵
        Runs ping.exe
        
        PID:5024
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        19⤵
        
        PID:4548
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        20⤵
        
        PID:5428
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        21⤵
        
        PID:5972
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        22⤵
        
        PID:6072
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        23⤵
        Runs ping.exe
        
        PID:5248
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        20⤵
        
        PID:5436
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        21⤵
        
        PID:5652
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        22⤵
        
        PID:5040
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        23⤵
        
        PID:2580
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        24⤵
        Runs ping.exe
        
        PID:3140
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        21⤵
        
        PID:5728
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        22⤵
        
        PID:5912
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        23⤵
        
        PID:3992
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        24⤵
        
        PID:2136
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        25⤵
        
        PID:5820
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        22⤵
        
        PID:5944
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        23⤵
        
        PID:2940
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        24⤵
        
        PID:5384
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        23⤵
        
        PID:968
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        24⤵
        
        PID:5212
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        25⤵
        
        PID:5556
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        26⤵
        
        PID:5700
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        27⤵
        Runs ping.exe
        
        PID:5408
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        24⤵
        
        PID:5292
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        25⤵
        
        PID:1152
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        26⤵
        
        PID:996
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        27⤵
        
        PID:4668
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        28⤵
        Runs ping.exe
        
        PID:6032
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        25⤵
        
        PID:5572
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        26⤵
        
        PID:2352
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        27⤵
        
        PID:5264
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        28⤵
        
        PID:5460
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        29⤵
        
        PID:5732
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        26⤵
        
        PID:5504
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        27⤵
        
        PID:6132
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        28⤵
        
        PID:5648
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        29⤵
        
        PID:5300
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        30⤵
        Runs ping.exe
        
        PID:5996
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        27⤵
        
        PID:5948
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        28⤵
        
        PID:5324
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        29⤵
        
        PID:2124
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        30⤵
        
        PID:4412
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        31⤵
        Runs ping.exe
        
        PID:4712
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        28⤵
        
        PID:5480
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        29⤵
        
        PID:3584
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        30⤵
        
        PID:4600
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        31⤵
        
        PID:1392
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        32⤵
        
        PID:5360
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        29⤵
        
        PID:5928
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        30⤵
        
        PID:5908
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        31⤵
        
        PID:2756
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        32⤵
        
        PID:2464
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        33⤵
        Runs ping.exe
        
        PID:5660
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        30⤵
        
        PID:5884
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        31⤵
        
        PID:4032
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        32⤵
        
        PID:5532
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        33⤵
        
        PID:4328
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        34⤵
        Runs ping.exe
        
        PID:2272
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        31⤵
        
        PID:1884
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        32⤵
        
        PID:5180
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        33⤵
        
        PID:4436
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        34⤵
        
        PID:5544
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        35⤵
        Runs ping.exe
        
        PID:5340
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        32⤵
        
        PID:5312
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        33⤵
        
        PID:2760
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        34⤵
        
        PID:6064
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        33⤵
        
        PID:6104
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        34⤵
        
        PID:4256
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        35⤵
        
        PID:5552
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        36⤵
        
        PID:6004
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        37⤵
        
        PID:452
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        34⤵
        
        PID:1136
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        35⤵
        
        PID:688
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        36⤵
        
        PID:4792
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        37⤵
        
        PID:5916
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        38⤵
        
        PID:556
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        35⤵
        
        PID:5760
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        36⤵
        
        PID:3992
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        37⤵
        
        PID:5800
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        38⤵
        
        PID:5644
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        39⤵
        Runs ping.exe
        
        PID:1152
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        36⤵
        
        PID:4640
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        37⤵
        
        PID:5512
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        38⤵
        
        PID:4304
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        39⤵
        
        PID:5820
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        40⤵
        Runs ping.exe
        
        PID:5320
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        37⤵
        
        PID:5148
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        38⤵
        
        PID:4708
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        39⤵
        
        PID:5160
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        40⤵
        
        PID:2660
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        41⤵
        Runs ping.exe
        
        PID:5324
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        38⤵
        
        PID:5564
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        39⤵
        
        PID:5884
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        40⤵
        
        PID:964
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        41⤵
        
        PID:2352
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        42⤵
        Runs ping.exe
        
        PID:5604
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        39⤵
        
        PID:4600
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        40⤵
        
        PID:5092
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        41⤵
        
        PID:6096
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        42⤵
        
        PID:6044
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        43⤵
        
        PID:2424
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        40⤵
        
        PID:5392
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        41⤵
        
        PID:3652
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        42⤵
        
        PID:5420
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        41⤵
        
        PID:5460
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        42⤵
        
        PID:5568
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        43⤵
        
        PID:5704
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        44⤵
        
        PID:6012
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        45⤵
        Runs ping.exe
        
        PID:5452
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        42⤵
        
        PID:5840
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        43⤵
        
        PID:5356
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        44⤵
        
        PID:4600
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        45⤵
        
        PID:1084
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        46⤵
        
        PID:5676
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        43⤵
        
        PID:5136
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        44⤵
        
        PID:3352
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        45⤵
        
        PID:1840
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        46⤵
        
        PID:5648
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        47⤵
        
        PID:2172
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        44⤵
        
        PID:1976
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        45⤵
        
        PID:2024
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        46⤵
        
        PID:2760
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        47⤵
        
        PID:5640
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        48⤵
        
        PID:3220
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        45⤵
        
        PID:6068
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        46⤵
        
        PID:5316
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        47⤵
        
        PID:1760
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        48⤵
        
        PID:452
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        49⤵
        
        PID:5860
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        46⤵
        
        PID:4900
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        47⤵
        
        PID:5920
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        48⤵
        
        PID:1732
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        49⤵
        
        PID:5236
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        50⤵
        Runs ping.exe
        
        PID:5412
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        47⤵
        
        PID:5768
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        48⤵
        
        PID:5828
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        49⤵
        
        PID:5884
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        50⤵
        
        PID:1616
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        51⤵
        Runs ping.exe
        
        PID:1748
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        48⤵
        
        PID:4820
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        49⤵
        
        PID:5720
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        50⤵
        
        PID:5992
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        49⤵
        
        PID:5288
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        50⤵
        
        PID:5696
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        51⤵
        
        PID:2760
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        52⤵
        
        PID:6016
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        53⤵
        
        PID:5528
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        50⤵
        
        PID:4080
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        51⤵
        
        PID:4376
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        52⤵
        
        PID:6008
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        53⤵
        
        PID:4528
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        54⤵
        
        PID:3212
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        51⤵
        
        PID:5932
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        52⤵
        
        PID:5804
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        53⤵
        
        PID:4484
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        54⤵
        
        PID:5936
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        55⤵
        
        PID:5712
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        52⤵
        
        PID:5332
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        53⤵
        
        PID:4036
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        54⤵
        
        PID:2940
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        55⤵
        
        PID:3836
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        56⤵
        
        PID:5372
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        53⤵
        
        PID:2824
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        54⤵
        
        PID:5536
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        55⤵
        
        PID:3652
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        56⤵
        
        PID:1836
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        57⤵
        
        PID:5884
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        54⤵
        
        PID:5560
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        55⤵
        
        PID:5800
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        56⤵
        
        PID:3244
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        57⤵
        
        PID:6008
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        58⤵
        Runs ping.exe
        
        PID:3256
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        55⤵
        
        PID:4080
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        56⤵
        
        PID:2760
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        57⤵
        
        PID:1760
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        58⤵
        
        PID:4820
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        59⤵
        
        PID:5172
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        56⤵
        
        PID:1504
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        57⤵
        
        PID:4208
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        58⤵
        
        PID:5292
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        59⤵
        
        PID:1696
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        60⤵
        
        PID:5124
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        57⤵
        
        PID:3660
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        58⤵
        
        PID:5772
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        59⤵
        
        PID:2196
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        58⤵
        
        PID:4708
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        59⤵
        
        PID:1252
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        60⤵
        
        PID:4876
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        61⤵
        
        PID:3352
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        62⤵
        Runs ping.exe
        
        PID:6004
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        59⤵
        
        PID:4808
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        60⤵
        
        PID:1904
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        61⤵
        
        PID:4048
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        62⤵
        
        PID:3228
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        63⤵
        
        PID:2092
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        60⤵
        
        PID:4436
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        61⤵
        
        PID:2352
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        62⤵
        
        PID:4440
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        63⤵
        
        PID:5184
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        64⤵
        
        PID:6140
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        61⤵
        
        PID:756
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        62⤵
        
        PID:4368
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        63⤵
        
        PID:5988
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        64⤵
        
        PID:5528
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        65⤵
        
        PID:4808
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        62⤵
        
        PID:6108
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        63⤵
        
        PID:3992
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        64⤵
        
        PID:5888
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        65⤵
        
        PID:5636
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        66⤵
        Runs ping.exe
        
        PID:5116
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        63⤵
        
        PID:5660
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        64⤵
        
        PID:5128
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        65⤵
        
        PID:4072
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        66⤵
        
        PID:6052
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        67⤵
        
        PID:2088
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        64⤵
        
        PID:2940
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        65⤵
        
        PID:4876
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        66⤵
        
        PID:3816
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        67⤵
        
        PID:5328
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        68⤵
        Runs ping.exe
        
        PID:4800
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        65⤵
        
        PID:5588
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        66⤵
        
        PID:5752
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        67⤵
        
        PID:5280
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        66⤵
        
        PID:1504
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        67⤵
        
        PID:4120
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        68⤵
        
        PID:5168
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        69⤵
        
        PID:5556
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        70⤵
        Runs ping.exe
        
        PID:5548
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        67⤵
        
        PID:5456
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        68⤵
        
        PID:4196
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        69⤵
        
        PID:212
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        70⤵
        
        PID:5924
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        71⤵
        Runs ping.exe
        
        PID:5992
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        68⤵
        
        PID:4368
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        69⤵
        
        PID:6132
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        70⤵
        
        PID:5284
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        71⤵
        
        PID:1016
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        72⤵
        
        PID:4296
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        69⤵
        
        PID:5828
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        70⤵
        
        PID:5052
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        71⤵
        
        PID:5144
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        72⤵
        
        PID:5716
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        73⤵
        Runs ping.exe
        
        PID:4600
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        70⤵
        
        PID:3008
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        71⤵
        
        PID:5860
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        72⤵
        
        PID:5204
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        73⤵
        
        PID:5868
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        74⤵
        Runs ping.exe
        
        PID:5984
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        71⤵
        
        PID:6036
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        72⤵
        
        PID:5812
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        73⤵
        
        PID:4484
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        74⤵
        
        PID:2092
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        75⤵
        
        PID:540
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        72⤵
        
        PID:2516
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        73⤵
        
        PID:6004
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        74⤵
        
        PID:5964
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        73⤵
        
        PID:4032
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        74⤵
        
        PID:4116
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        75⤵
        
        PID:1776
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        76⤵
        
        PID:6004
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        77⤵
        Runs ping.exe
        
        PID:2224
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        74⤵
        
        PID:2580
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        75⤵
        
        PID:6052
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        76⤵
        
        PID:5880
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        77⤵
        
        PID:6116
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        78⤵
        
        PID:1152
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        75⤵
        
        PID:6104
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        76⤵
        
        PID:3008
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        77⤵
        
        PID:5768
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        78⤵
        
        PID:6028
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        79⤵
        Runs ping.exe
        
        PID:5672
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        76⤵
        
        PID:1136
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        77⤵
        
        PID:4708
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        78⤵
        
        PID:5656
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        79⤵
        
        PID:4184
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        80⤵
        Runs ping.exe
        
        PID:5800
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        77⤵
        
        PID:5884
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        78⤵
        
        PID:4596
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        79⤵
        
        PID:2072
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        80⤵
        
        PID:3476
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        81⤵
        
        PID:3972
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        78⤵
        
        PID:2744
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        79⤵
        
        PID:1476
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        80⤵
        
        PID:2936
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        81⤵
        
        PID:5216
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        82⤵
        Runs ping.exe
        
        PID:4984
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        79⤵
        
        PID:5644
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        80⤵
        
        PID:4436
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        81⤵
        
        PID:5868
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        82⤵
        
        PID:5580
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        83⤵
        Runs ping.exe
        
        PID:5408
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        80⤵
        
        PID:4600
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        81⤵
        
        PID:4532
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        82⤵
        
        PID:5840
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        83⤵
        
        PID:6128
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        84⤵
        Runs ping.exe
        
        PID:2980
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        81⤵
        
        PID:5420
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        82⤵
        
        PID:6108
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        83⤵
        
        PID:5392
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        84⤵
        
        PID:5856
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        85⤵
        
        PID:6000
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        82⤵
        
        PID:5436
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        83⤵
        
        PID:5320
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        84⤵
        
        PID:5960
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        85⤵
        
        PID:5300
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        86⤵
        Runs ping.exe
        
        PID:6036
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        83⤵
        
        PID:4008
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        84⤵
        
        PID:4872
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        85⤵
        
        PID:4504
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        86⤵
        
        PID:4256
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        87⤵
        
        PID:5312
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        84⤵
        
        PID:5516
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        85⤵
        
        PID:2348
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        86⤵
        
        PID:5920
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        87⤵
        
        PID:5132
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        88⤵
        Runs ping.exe
        
        PID:5672
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        85⤵
        
        PID:5124
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        86⤵
        
        PID:3252
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        87⤵
        
        PID:3900
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        88⤵
        
        PID:5340
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        89⤵
        Runs ping.exe
        
        PID:3720
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        86⤵
        
        PID:4900
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        87⤵
        
        PID:5656
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        88⤵
        
        PID:5140
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        89⤵
        
        PID:3140
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        90⤵
        Runs ping.exe
        
        PID:4640
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        87⤵
        
        PID:6048
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        88⤵
        
        PID:912
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        89⤵
        
        PID:952
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        90⤵
        
        PID:5632
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        91⤵
        Runs ping.exe
        
        PID:5816
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        88⤵
        
        PID:5592
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        89⤵
        
        PID:1152
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        90⤵
        
        PID:5532
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        91⤵
        
        PID:4080
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        92⤵
        
        PID:5608
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        89⤵
        
        PID:2304
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        90⤵
        
        PID:6088
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        91⤵
        
        PID:1184
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        92⤵
        
        PID:5244
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        93⤵
        
        PID:5264
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        90⤵
        
        PID:5904
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        91⤵
        
        PID:5908
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        92⤵
        
        PID:6092
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        93⤵
        
        PID:3016
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        94⤵
        Runs ping.exe
        
        PID:3528
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        91⤵
        
        PID:540
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        92⤵
        
        PID:1776
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        93⤵
        
        PID:5900
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        94⤵
        
        PID:3264
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        95⤵
        
        PID:2336
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        92⤵
        
        PID:64
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        93⤵
        
        PID:5784
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        94⤵
        
        PID:5472
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        95⤵
        
        PID:1108
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        96⤵
        
        PID:1252
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        93⤵
        
        PID:2024
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        94⤵
        
        PID:964
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        95⤵
        
        PID:1616
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        96⤵
        
        PID:5640
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        97⤵
        
        PID:5232
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        94⤵
        
        PID:5804
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        95⤵
        
        PID:5320
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        96⤵
        
        PID:5620
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        97⤵
        
        PID:2424
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        98⤵
        
        PID:4268
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        95⤵
        
        PID:1480
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        96⤵
        
        PID:952
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        97⤵
        
        PID:3544
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        98⤵
        
        PID:5988
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        99⤵
        
        PID:5720
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        96⤵
        
        PID:3492
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        97⤵
        
        PID:4040
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        98⤵
        
        PID:6080
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        99⤵
        
        PID:5716
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        100⤵
        Runs ping.exe
        
        PID:2432
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        97⤵
        
        PID:700
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        98⤵
        
        PID:5564
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        99⤵
        
        PID:4292
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        100⤵
        
        PID:4940
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        101⤵
        
        PID:5756
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        98⤵
        
        PID:5172
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        99⤵
        
        PID:4560
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        100⤵
        
        PID:5560
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        101⤵
        
        PID:5352
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        102⤵
        Runs ping.exe
        
        PID:5764
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        99⤵
        
        PID:2068
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        100⤵
        
        PID:2136
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        101⤵
        
        PID:5660
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        102⤵
        
        PID:936
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        103⤵
        
        PID:2460
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        100⤵
        
        PID:3668
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        101⤵
        
        PID:4440
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        102⤵
        
        PID:5568
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        101⤵
        
        PID:684
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        102⤵
        
        PID:5392
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        103⤵
        
        PID:6136
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        104⤵
        
        PID:5176
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        105⤵
        
        PID:5280
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        102⤵
        
        PID:3972
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        103⤵
        
        PID:5932
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        104⤵
        
        PID:2936
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        105⤵
        
        PID:5784
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        106⤵
        
        PID:6116
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        103⤵
        
        PID:5380
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        104⤵
        
        PID:1392
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        105⤵
        
        PID:5796
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        106⤵
        
        PID:1064
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        107⤵
        
        PID:1084
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        104⤵
        
        PID:184
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        105⤵
        
        PID:3620
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        106⤵
        
        PID:3732
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        107⤵
        
        PID:4600
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        108⤵
        
        PID:5388
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        105⤵
        
        PID:4596
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        106⤵
        
        PID:5428
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        107⤵
        
        PID:5832
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        108⤵
        
        PID:5860
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        109⤵
        Runs ping.exe
        
        PID:5672
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        106⤵
        
        PID:684
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        107⤵
        
        PID:6016
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        108⤵
        
        PID:5816
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        109⤵
        
        PID:5328
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        110⤵
        Runs ping.exe
        
        PID:4940
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        107⤵
        
        PID:3972
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        108⤵
        
        PID:5716
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        109⤵
        
        PID:5788
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        108⤵
        
        PID:2420
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        109⤵
        
        PID:1904
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        110⤵
        
        PID:5596
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        111⤵
        
        PID:5964
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        112⤵
        
        PID:5660
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        109⤵
        
        PID:5452
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        110⤵
        
        PID:3212
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        111⤵
        
        PID:1696
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        112⤵
        
        PID:1388
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        113⤵
        Runs ping.exe
        
        PID:2168
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        110⤵
        
        PID:1476
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        111⤵
        
        PID:5576
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        112⤵
        
        PID:6112
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        113⤵
        
        PID:5108
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        114⤵
        
        PID:5884
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        111⤵
        
        PID:1148
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        112⤵
        
        PID:2448
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        113⤵
        
        PID:1360
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        114⤵
        
        PID:3584
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        115⤵
        
        PID:4268
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        112⤵
        
        PID:400
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        113⤵
        
        PID:3576
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        114⤵
        
        PID:4020
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        115⤵
        
        PID:5672
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        116⤵
        
        PID:5488
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        113⤵
        
        PID:5600
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        114⤵
        
        PID:1152
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        115⤵
        
        PID:6052
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        116⤵
        
        PID:3708
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        117⤵
        Runs ping.exe
        
        PID:3504
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        114⤵
        
        PID:2940
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        115⤵
        
        PID:5084
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        116⤵
        
        PID:5116
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        117⤵
        
        PID:5592
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        118⤵
        Runs ping.exe
        
        PID:5948
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        115⤵
        
        PID:5900
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        116⤵
        
        PID:5128
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        117⤵
        
        PID:1252
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        118⤵
        
        PID:5248
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        119⤵
        Runs ping.exe
        
        PID:5500
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        116⤵
        
        PID:5476
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        117⤵
        
        PID:4600
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        118⤵
        
        PID:1084
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        119⤵
        
        PID:5928
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        120⤵
        Runs ping.exe
        
        PID:2280
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        117⤵
        
        PID:5860
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        118⤵
        
        PID:5208
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        119⤵
        
        PID:5676
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        118⤵
        
        PID:5384
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        119⤵
        
        PID:5192
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        120⤵
        
        PID:2728
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        121⤵
        
        PID:384
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        122⤵
        Runs ping.exe
        
        PID:2960
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        119⤵
        
        PID:5160
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        120⤵
        
        PID:5424
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        121⤵
        
        PID:3492
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        122⤵
        
        PID:1672
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        123⤵
        Runs ping.exe
        
        PID:2824
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        120⤵
        
        PID:3152
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        121⤵
        
        PID:5596
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        122⤵
        
        PID:5516
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        123⤵
        
        PID:5716
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        124⤵
        
        PID:3720
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        121⤵
        
        PID:4060
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        122⤵
        
        PID:5052
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        123⤵
        
        PID:3844
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        124⤵
        
        PID:3652
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        125⤵
        
        PID:4036
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        122⤵
        
        PID:4108
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        123⤵
        
        PID:2744
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        124⤵
        
        PID:2224
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        125⤵
        
        PID:5228
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        126⤵
        
        PID:6120
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        123⤵
        
        PID:5804
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        124⤵
        
        PID:5812
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        125⤵
        
        PID:2804
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        126⤵
        
        PID:5240
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        127⤵
        
        PID:936
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        124⤵
        
        PID:5408
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        125⤵
        
        PID:2068
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        126⤵
        
        PID:1148
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        127⤵
        
        PID:6104
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        128⤵
        
        PID:5648
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        125⤵
        
        PID:1732
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        126⤵
        
        PID:1388
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        127⤵
        
        PID:996
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        126⤵
        
        PID:6028
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        127⤵
        
        PID:2104
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        128⤵
        
        PID:5260
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        129⤵
        
        PID:5176
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        130⤵
        Runs ping.exe
        
        PID:5532
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        127⤵
        
        PID:5512
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        128⤵
        
        PID:3352
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        129⤵
        
        PID:6088
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        130⤵
        
        PID:5360
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        131⤵
        
        PID:2252
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        128⤵
        
        PID:5436
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        129⤵
        
        PID:5140
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        130⤵
        
        PID:3928
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        131⤵
        
        PID:5896
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        132⤵
        Runs ping.exe
        
        PID:3504
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        129⤵
        
        PID:5944
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        130⤵
        
        PID:5772
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        131⤵
        
        PID:5588
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        132⤵
        
        PID:5700
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        133⤵
        
        PID:2412
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        130⤵
        
        PID:5244
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        131⤵
        
        PID:3480
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        132⤵
        
        PID:3732
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        133⤵
        
        PID:5032
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        134⤵
        
        PID:1152
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        131⤵
        
        PID:2352
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        132⤵
        
        PID:5324
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        133⤵
        
        PID:5672
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        134⤵
        
        PID:4356
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        135⤵
        
        PID:6080
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        132⤵
        
        PID:5744
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        133⤵
        
        PID:3584
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        134⤵
        
        PID:5276
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        135⤵
        
        PID:1660
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        136⤵
        Runs ping.exe
        
        PID:6096
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        133⤵
        
        PID:6032
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        134⤵
        
        PID:5572
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        135⤵
        
        PID:1840
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        134⤵
        
        PID:1748
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        135⤵
        
        PID:2172
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        136⤵
        
        PID:5796
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        137⤵
        
        PID:2800
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        138⤵
        
        PID:1760
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        135⤵
        
        PID:5376
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        136⤵
        
        PID:4516
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        137⤵
        
        PID:4072
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        138⤵
        
        PID:5744
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        139⤵
        
        PID:684
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        136⤵
        
        PID:6120
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        137⤵
        
        PID:3840
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        138⤵
        
        PID:5808
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        139⤵
        
        PID:64
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        140⤵
        
        PID:3588
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        137⤵
        
        PID:5716
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        138⤵
        
        PID:1940
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        139⤵
        
        PID:3660
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        140⤵
        
        PID:512
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        141⤵
        
        PID:2540
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        138⤵
        
        PID:5900
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        139⤵
        
        PID:884
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        140⤵
        
        PID:2304
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        141⤵
        
        PID:4940
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        142⤵
        
        PID:5128
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        139⤵
        
        PID:2804
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        140⤵
        
        PID:5360
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        141⤵
        
        PID:3972
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        142⤵
        
        PID:5988
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        143⤵
        Runs ping.exe
        
        PID:3476
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        140⤵
        
        PID:5804
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        141⤵
        
        PID:5860
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        142⤵
        
        PID:5452
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        143⤵
        
        PID:6096
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        144⤵
        Runs ping.exe
        
        PID:1976
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        141⤵
        
        PID:6024
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        142⤵
        
        PID:2660
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        143⤵
        
        PID:432
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        142⤵
        
        PID:5108
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        143⤵
        
        PID:5920
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        144⤵
        
        PID:5948
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        145⤵
        
        PID:5816
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        146⤵
        
        PID:5276
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        143⤵
        
        PID:5348
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        144⤵
        
        PID:3652
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        145⤵
        
        PID:5052
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        144⤵
        
        PID:5972
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        145⤵
        
        PID:996
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        146⤵
        
        PID:3256
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        145⤵
        
        PID:5492
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        146⤵
        
        PID:2252
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        147⤵
        
        PID:4296
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        146⤵
        
        PID:5744
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        147⤵
        
        PID:5956
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        148⤵
        
        PID:912
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        149⤵
        
        PID:2660
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        150⤵
        
        PID:5600
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        147⤵
        
        PID:5768
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        148⤵
        
        PID:656
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        149⤵
        
        PID:1124
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        150⤵
        
        PID:2856
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        151⤵
        
        PID:540
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        148⤵
        
        PID:5424
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        149⤵
        
        PID:1748
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        150⤵
        
        PID:4940
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        151⤵
        
        PID:4428
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        152⤵
        
        PID:5196
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        149⤵
        
        PID:3836
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        150⤵
        
        PID:3048
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        151⤵
        
        PID:5884
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        150⤵
        
        PID:3344
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        151⤵
        
        PID:6088
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        152⤵
        
        PID:3644
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        153⤵
        
        PID:2236
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        154⤵
        Runs ping.exe
        
        PID:1260
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        151⤵
        
        PID:5916
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        152⤵
        
        PID:4048
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        153⤵
        
        PID:5776
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        154⤵
        
        PID:6076
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        155⤵
        
        PID:4568
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        152⤵
        
        PID:5312
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        153⤵
        
        PID:4044
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        154⤵
        
        PID:3836
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        155⤵
        
        PID:6060
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        156⤵
        Runs ping.exe
        
        PID:1504
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        153⤵
        
        PID:5716
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        154⤵
        
        PID:5364
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        155⤵
        
        PID:4556
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        156⤵
        
        PID:3576
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        157⤵
        Runs ping.exe
        
        PID:5352
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        154⤵
        
        PID:5404
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        155⤵
        
        PID:5736
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        156⤵
        
        PID:4356
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        157⤵
        
        PID:5272
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        158⤵
        
        PID:4816
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        155⤵
        
        PID:5436
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        156⤵
        
        PID:5668
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        157⤵
        
        PID:3848
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        158⤵
        
        PID:2420
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 1 localhost
        159⤵
        
        PID:5828
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        156⤵
        
        PID:4184
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        157⤵
        
        PID:1532
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        158⤵
        
        PID:3644
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        157⤵
        
        PID:5428
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        158⤵
        
        PID:1388
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        159⤵
        
        PID:808
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\.bat""
        160⤵
        
        PID:5192
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        158⤵
        
        PID:5740
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        159⤵
        
        PID:3840
        
        C:\Users\Admin\AppData\Local\Temp\v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2.exe"
        160⤵
        
        PID:3348
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        159⤵
        
        PID:5604
        
        C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"
        160⤵
        
        PID:5964
        
        C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe"
        160⤵
        
        PID:4876

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5256 --field-trial-handle=2236,i,5367110156796017614,12594004256180761011,262144 --variations-seed-version /prefetch:8
1⤵
PID:1524

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\v2.exe.log

Filesize
422B

MD5
c0f88724728a6db54e84f6f0ad0e2a78

SHA1
e685c13e29d447e73d7a11c53f7ae6d27dffecb6

SHA256
0d578f2a54fea6fffd0e63e4e9603154cbc84cc99a15fd5682c5ec638c5d3ed0

SHA512
8f1646b3708e539861edb223b3d694bc98d1761a76d8fce3d1d3d9fda6ab71bc141fd4d442c54b14b254533a74bb86dc63e7fb09abbc259cfac5156af5b18664

Download Submit
C:\Users\Admin\AppData\Local\Temp\.bat

Filesize
168B

MD5
b171e3bdfe3db3cdb6d3396477038d75

SHA1
358d668569db1ff82aeaaf9f5f06bc988fd8c670

SHA256
c55f25edd2b0843c5a1bfc4c6be8a0a75f78fb466f98281af66320a3a2136da3

SHA512
f98d916810d0554023f0ed8a5961e2d222ec4c3d71de243ec984ce228778c92b94a2f05e602b60635f7b5b42e307d3f5816c26cd4c440f3652ceec958dcdd5a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\BouncyCastle.Crypto.dll

Filesize
554KB

MD5
4b11b4cc8b4f4a150eb8a3443395c938

SHA1
d5be27aa125e3cc7f10d025101d847d1e63c1ab9

SHA256
e26faa7b670c9223b527f8ab97a8c417dfea9cb3ba6231ae284668f256705f54

SHA512
4d2757b449cc77852063f88452b57a56944d8e9b89815c9e448e8cf380b36862c456e7b0038889851719951931ad79d3f19c834d098f84748af6a4c51c51e3f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\BouncyCastle.Crypto.dll

Filesize
638KB

MD5
9e382f2f608cc93c92c9405543afb71e

SHA1
8befe54122b8ba2c8586d642d24e80959017d6a2

SHA256
135aa6d1b13cf5d950ddcb69af297d381ee0a67b9cda84d9919f0ff08e79ac91

SHA512
c5d8976d0ddb809f8b18a9279456476dfd01a054313001d985e3a02eefeb5b6a17264804fe2e30903c34424d9a4f04ce3391eede4b02059c0df51e208f89098a

Download Submit
C:\Users\Admin\AppData\Local\Temp\BouncyCastle.Crypto.dll

Filesize
892KB

MD5
38f255a1b5235c4bdc75f8bf2235f092

SHA1
3728e0f90243c2b38c8cbef7ff1b5934e06a20f9

SHA256
b9cf73e8ce72a26e8c33c221e1a6b208b28d37e7fee744df7a714805eee66ea6

SHA512
b6d344365d8a0435fb7fad7d6d37fa78cea7c9bf937bf8a28cef2708b47871c2dcff62d743775d94da5c49f5ed15032a1875e92f76b9c25722295fc29df1d1d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\BouncyCastle.Crypto.dll

Filesize
3.2MB

MD5
0cf454b6ed4d9e46bc40306421e4b800

SHA1
9611aa929d35cbd86b87e40b628f60d5177d2411

SHA256
e51721dc0647f4838b1abc592bd95fd8cb924716e8a64f83d4b947821fa1fa42

SHA512
85262f1bc67a89911640f59a759b476b30ca644bd1a1d9cd3213cc8aae16d7cc6ea689815f19b146db1d26f7a75772ceb48e71e27940e3686a83eb2cf7e46048

Download Submit
C:\Users\Admin\AppData\Local\Temp\BouncyCastle.Crypto.dll

Filesize
1.8MB

MD5
4ad7098c0534bfbd32d06aa1a7474b6c

SHA1
ac4709196b5e835e126aa339ad2a7de705e33c13

SHA256
80b18e653cff45aa97b21c97d16ffd13208f3475de723ae7f5d335e96fb56d55

SHA512
6bc0ec259996f2b8591cd5afde1adbefde4d7ef4572226e10beb086615bac719786d1de1ea14861681efa1b6050f0ecb8db609a9358ac931cabec953eb5e15ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\BouncyCastle.Crypto.dll

Filesize
1.8MB

MD5
0511898f91eca4b64b5c65bf136ac5f4

SHA1
26b27df990c31ca7fdfc16f42958f4901cf94e4c

SHA256
f02cf2d7cea9fdab4dce5d856e4122668c82d76421730032832e43d41b59be21

SHA512
af28f69c2a2b29be1e4bb9195e8cfb8cee1ba33d443487b56d891e8e7ac8ab0c35a7212c5457d20f3511b08dddd6481d218dbbc0d2f8159219804feb5df6d7b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\EntityFramework.SqlServer.dll

Filesize
415KB

MD5
7501cb4cea3d2da47cd53c1402770f1d

SHA1
e2a99561c12b445397abf307215cbf33ba3aa3ba

SHA256
658d6d2856d0553191d48af8614e4b914975890a3fb8756efd4db110d2b3ff84

SHA512
29a13c6ca7e2f3eb9209f673d173a30314cf76350d82005cdd0633937aa6f2ddab0a944ac6d1920f7c12de3948a3fde4db1f99a09515ab402fe3073358fe4a5a

Download Submit
C:\Users\Admin\AppData\Local\Temp\EntityFramework.SqlServer.dll

Filesize
368KB

MD5
5309645e7ecbfd482b3cfd1337e5467f

SHA1
0e0ba5030efa7d8e8832ae054c767813037b8b83

SHA256
0f8e498fbfa57748f8262e0148f29457eb4fe18b0ff36c0c384734ddec8f636e

SHA512
6e2ea6a65ae58b54bf52bba0e63ad7652ef0d6beff5770fa633a55673d401452052de9bc6784503addb0b27e66a8ab2bb4ec38751dd6bfd3bdaa39285053b7da

Download Submit
C:\Users\Admin\AppData\Local\Temp\EntityFramework.SqlServer.dll

Filesize
572KB

MD5
f32ce9a5a866313d1a3391aa42153f4a

SHA1
7404383a681a2ec1c5bf24152fa298e934f53783

SHA256
4583f9d1e62c90e3bc41d9feacca8152e3bb067b767e806872772ea9a55803e9

SHA512
a276ed47e0687699e844dfb8215b4ef922eb6b853d7ca4bbf707b4439c26f8afc6886f00af0b3ba76e2dd322a0870594d81bcdc2095656a2e5b78568dc5f3f51

Download Submit
C:\Users\Admin\AppData\Local\Temp\EntityFramework.dll

Filesize
475KB

MD5
a0b723ef970f840d98de4636c5189f59

SHA1
56b9baad6b9fe6310e77e6ee543774e264a24018

SHA256
84d35c14fea4f007acff1b3d63ea7e3d2b711df9bf13b75398a9ee79d921a66e

SHA512
8cbe887cb1e837c86365a23a675e1029d75bda4b96c096ae4aeb8818346781705dad964aa5ceac026c32bf2324f21945d7760b8129f79bd7baba4c2c10b4cda7

Download Submit
C:\Users\Admin\AppData\Local\Temp\EntityFramework.dll

Filesize
268KB

MD5
5be5c8ad1421e5a119aadd572bdd4761

SHA1
4287d5a7ed44dca0db770bde1229053a26c62bda

SHA256
1c4b0cbe9d88ea325d89412b2dda319e86940c8a97b94d4174503f0740d79662

SHA512
1be47010bc88c7a9709ae7fd5ac1e091bafcea72c2ac8d737c536886e84e8666e71434ef4d9a50b75c676f9ea84febe16dee168ea12ca310cc5ed0238808484e

Download Submit
C:\Users\Admin\AppData\Local\Temp\EntityFramework.dll

Filesize
470KB

MD5
a3f185ce0fab12ee28acb596b11e2d1f

SHA1
da820c7e512ac5782d986c0771f9fff826b6759e

SHA256
84a7be41140242e5e87d8325af98e020dcbdb2a0a7c525cb128d90f66e9a86e6

SHA512
3f5d8836d125244051d93a5421a57c0430498657cff164a875f890a76b55db2bae2c73a69071fbbf22511058a2240eaa93f6e4f488e8d7425be8e45d462220df

Download Submit
C:\Users\Admin\AppData\Local\Temp\EntityFramework.dll

Filesize
4.4MB

MD5
6478b641a5f7d5db00dac027e7b907f8

SHA1
6f2355672b9c72fa2400845180b34b569f26037d

SHA256
ba1247cbfb586de6de804b8fb600eb657a34cd9be3a4f31e10df057681fcb1f2

SHA512
36ba4ba44603787245896ee8d275e46e47f28bfd9deca1e2e9d6c8ee1d0574b111a1c766e6e85fd5a20cfd3fd19734ff998df96e39a44b15490c0c2186ac5568

Download Submit
C:\Users\Admin\AppData\Local\Temp\EntityFramework.dll

Filesize
1.6MB

MD5
dc055588bd520e08cebff6588d7b3af8

SHA1
0f735413d29bfe76b283c9edc1376771934465c1

SHA256
4abf20fcb605adb8a5f5d32c4f5bdda10a101859c9590cb353577d7672bac90f

SHA512
f9c617fb1cbdecf65b6b71c2a91b5ab723fb6fb5b194461727d07624625a3e0c5e6bffbf48f1d114c0cf019c7828d4222df49c83d15910c5108292a9c32fe327

Download Submit
C:\Users\Admin\AppData\Local\Temp\EntityFramework.dll

Filesize
1.5MB

MD5
0fb2af026adf6428180a6fd1bc37c58a

SHA1
caeae9ffcb733bb6e37d99cf5bf1eb7a8d451365

SHA256
b37b53e078b0e16e7bf9505ca0f5ffb5c370c3b1c71bbc61baed178a31670a9a

SHA512
72bbec47865dc1859ec6628888b3674e2ad8c0a7f0efddfbf583f238b61501508f56348e8d46dcbebb6dd25ed73c6ababaa433ffc7d495f57a3724a6a6659802

Download Submit
C:\Users\Admin\AppData\Local\Temp\Newtonsoft.Json.dll

Filesize
450KB

MD5
283b459305a31bd239c18ca750a6a240

SHA1
f6289c4b62523b6b672dfeb5d1d055f9a4bdbf99

SHA256
f3a764b34135cc101a3d82f5f579650f2da975468dd1f4ba2d3282f727e58411

SHA512
60a30d82f89ca1e931814f599f153a07cf386c0aec0326b180f6668847365f944d755f286485f6d4139e0f8ff771c2a0fcf74ec26fe55c96fa3d319f8d3c9720

Download Submit
C:\Users\Admin\AppData\Local\Temp\Newtonsoft.Json.dll

Filesize
571KB

MD5
169b6d383b7c650ab3ae2129397a6cf3

SHA1
fcaef7defb04301fd55fb1421bb15ef96d7040d6

SHA256
b896083feb2bdedc1568b62805dbd354c55e57f2d2469a52aec6c98f4ec2dedf

SHA512
7a7a7bdb508b8bf177249251c83b65a2ef4a5d8b29397cab130cb8444b23888678673a9a2e4b1c74cc095b358f923b9e7e5a91bfa8c240412d95765851f1dd87

Download Submit
C:\Users\Admin\AppData\Local\Temp\SQLite.Interop.dll

Filesize
683KB

MD5
ad1b58a0cb6edab3f64a316a94263894

SHA1
b4bfa14253538683fa3e43ab1e16e3cf1ecfd2f4

SHA256
db33fb80103decfb5c5a258ca63e49752b6d6df2c321544127c4e0a7b4ba260c

SHA512
1b59da21c6644c4f1d6f103ebe6d7048c4890a55c882202cd829df77ee13096b3e134a63fc3629e63c755a18f97abc115a34bd1ee405ab52cccfa067fc64052b

Download Submit
C:\Users\Admin\AppData\Local\Temp\SQLite.Interop.dll

Filesize
420KB

MD5
9dabe6bb35e2f6795643aa0db6d399fa

SHA1
49a6d7a99908c63d8f76a5985cb264a9b4354268

SHA256
bec5963bcd32d897fb843e514dc0d282dbe89aba84235212c5d15c63264c0b28

SHA512
a9ad8ecdc4d338b61673b9627e582e6e6e75fb2ed6f21e6a7c6478fcecc4a9065dc44807690775482e9970da8b3e5c12392d1eae6ac315516bc9958766d98dd4

Download Submit
C:\Users\Admin\AppData\Local\Temp\SQLite.Interop.dll

Filesize
1.3MB

MD5
ae96a8ce9ab82270421b5ac6601de884

SHA1
41bd2d72b4b27f9a1b293cf19606a58f769c3605

SHA256
083dba665508f0c57acdbbc7df7ee901699cfae9496e03d8c9690306c4799b0f

SHA512
e55947b407ef52fba42e2ac122410c02a75426240e8add2daffdd09c9b6e0e207184fa027d0ae8bd867043b25d22b2ddd1ee7211275a0f74bd10334d7ca19342

Download Submit
C:\Users\Admin\AppData\Local\Temp\SQLite.Interop.dll

Filesize
1.7MB

MD5
dbfaeb35df5a67ad84cd341dfe00aa4c

SHA1
74cf42a60d4327776c8585fd51abc8bd910ea75b

SHA256
f62e87dd712beac9b36f10fd3f5440dd99a0660d58a1894b5e761255af3de76e

SHA512
26272c2e2f19c6d8827b4817eaa71bbb1005729abb051ccd270cb3bcde7b0ab0b6bf75690be7489ffc6a56b4e58747d1912e306668b4e57fa83c05f59dfb94c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\SQLite.Interop.dll

Filesize
1.7MB

MD5
434b440dced5a162f22cb077ac2da0eb

SHA1
77f5543648301825615b7587a86cac7d3ff6cad8

SHA256
79b6b2c1090f4e37a9cb4d8cceae33faa7798431c2cb02af8188c99ac821a021

SHA512
0755c5f2dcf2cb7cfc7e618a708a7dc24e0ce5c7663ed9a9ec2cf7579cad904366d8874c6c58e6381a24c538cc5dfacc115323b97aaf881f19b9222dc2f9f015

Download Submit
C:\Users\Admin\AppData\Local\Temp\SQLite.Interop.dll

Filesize
1.1MB

MD5
b822c6fcc16d71b76d75c6c530f65d75

SHA1
d780610777ebdd173a95adbc38d0b32a01d3bab6

SHA256
647a86ab31a170f04b60755548c6f35067f1734ee9487491969c5dd6ded48c53

SHA512
5179e1cf46faec3ae45fc22fc3458ad1006d4be0aa49771220fbc8585a0e820a63105f2bfc507d124c6f49de87bcd2e61c1450d90d0ccbed1a835a519bda95a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\System.Data.SQLite.EF6.dll

Filesize
133KB

MD5
66d4d71d5589b058ec21eb8b8ea45968

SHA1
31a60c563f56d249e5baa3e076a4c6247de21693

SHA256
17641352adb2eae0c2117d28fbb7bc13adf828c0974e35eece6012bba8d63678

SHA512
71f5ba83ea4548414cc7a0f4151b6be82737a8835efc7860718cbbad3c5e5321a8c2e4810ff4aa1a656bd4b1aeb242a435ed23eb988fad12200e48d1191ff24c

Download Submit
C:\Users\Admin\AppData\Local\Temp\System.Data.SQLite.EF6.dll

Filesize
143KB

MD5
028c24222ef8c0b45075bd757ab61204

SHA1
b00432af5fe2d058ccd7c6c2ae336a8f61343f6f

SHA256
f24708befadb3119c49f2b354b92d770a09824d65586fc8a52157a1fe01d72bf

SHA512
912f8e4fab09175e8f33a066e6350ad4d1a82bd53d36235250cf312aeb92e7c33a6005e0494c2a1c9ce8f33e8f9fa3c017208bb5b38da955e68a971386ce7943

Download Submit
C:\Users\Admin\AppData\Local\Temp\System.Data.SQLite.EF6.dll

Filesize
203KB

MD5
162e50541954d792420156956b09d410

SHA1
f10943992ead2dd222df7ccfc76d74d495ef086d

SHA256
20d7e37fedce140669e2a2d89f4e7a67405134ca1876a55f9cf9ab0eae8f206e

SHA512
a86167344c9645387b6b0c95ab19f2adfee5573ab2c6068e38e3de0b94990379a948f0e10214b6f7dcf1f5e3159032217113267b8a7b4365f19ba970a8a51bf9

Download Submit
C:\Users\Admin\AppData\Local\Temp\System.Data.SQLite.Linq.dll

Filesize
203KB

MD5
355bbea5ee15d806e0d6bd6dbd25f494

SHA1
b41ebf0ff5c4effa1fd123845efe03764e91341e

SHA256
8e2ae9d4a03e95c714d7835310795b7e0434b8aa3448e6a5b106ad9dbba0158f

SHA512
ad453a26a22efb522126208a1e7ebee6ec429fde52f4a3d30212ef9f58e39714fd7f42d05031bf31992199aea573f9f1887dc83ed30093527d3e8b33476a4387

Download Submit
C:\Users\Admin\AppData\Local\Temp\System.Data.SQLite.dll

Filesize
392KB

MD5
5aad75982e85f6b0356c4248514a214b

SHA1
acabbb0ceae21b79a433783366e60cbf6aa1b4b5

SHA256
a0b1b94997455cd616f979b046aa7b06953c1098149df454b2d223ba98aa08ba

SHA512
88c94c9efb1f5493880ce6a64ebe872d763897b46747625267ebe1d3e4d74da0d105ca2edbe18dda691826480d947f56f0aeeb6614b958340ff95432a17d8b58

Download Submit
C:\Users\Admin\AppData\Local\Temp\System.Data.SQLite.dll

Filesize
410KB

MD5
056d3fcaf3b1d32ff25f513621e2a372

SHA1
851740bca46bab71d0b1d47e47f3eb8358cbee03

SHA256
66b64362664030bff1596cda2ec5bd5df48cc7c8313c32f771db4aa30a3f86f9

SHA512
ce47c581538f48a46d70279a62c702195beacbfafb48a5a862b3922625fe56f6887d1679c6d9366f946d3d2124cb31c2a3eacbbd14d601ea56e66575cdf46180

Download Submit
C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe

Filesize
128KB

MD5
277d411603cfe88369fd469e984aeb92

SHA1
982cf79176fa03e01e47cd7543b6a199ff06bf7f

SHA256
a47697ce57d3056f18fb663f08439c2e147dfb5089d843f46ea04fb95d32b399

SHA512
2553e2252d2e1e6589d1f2dcebbe6a4a344a885270bf5bd7c47993f1fe5ccac6af3bbf2a0a1d9cc0a6c48e3a6a0ebb2ec56ade5217b877a0c101fa7d695d0f93

Download Submit
C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe

Filesize
987KB

MD5
e2c7bd7a1ee059261e6730c2a7270087

SHA1
c3b21a0325e0318a7fdd9194f65e348001ee596a

SHA256
8960aa927f22e6737253906190345cdd41be2fd3501529a0ff608ca2a0029ccc

SHA512
301fa265283b6bdb7e5ecbe920ebbbadb5cd024403d2fd72c75657b47582cb36d73bbce85bcc43885a7ae54abe0707689e79f73a1661acbac4b0a2f3938c6562

Download Submit
C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe

Filesize
448KB

MD5
2638d337b9ab31247fd600999cd7b277

SHA1
67fb4ff7a45d377eeea02ae0679dca0b91ee3804

SHA256
bae61361fa0f44f2fb052edf63e5a025674365f5604aebcac02bb4c537e55d40

SHA512
f2ed0c56de62622b3cf71bb7597cbb8b5669c92d32196b08e4cb16af132cbb1dc3a418644f7442f0266e8e2a79076e3ce5993053506caba9d302539d746ff6bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe

Filesize
364KB

MD5
ad3b834163b3f84f58fcd43a205c0553

SHA1
a02561efaf22321e654b77b96412c5e952abc585

SHA256
2033e6af9c660a840744e32aedea68e606d66c77bc911050c80785ace65e0ce7

SHA512
eebfba90cb8042fd0218b083f6339c451319fd2672117d06c36d63e5af27aaaa1a102138673e3fa19dabe9105b59caeb6e646bbae702b8fd2d0780564a3a8835

Download Submit
C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe

Filesize
7.7MB

MD5
32b53fb7ea1ae556aabf2ae6080b36df

SHA1
e4e050a1ab40d3cba3922dae5fd494e0e56e7d2f

SHA256
0707fa0e3fe56c7d63adfb54b50a4f8601477131ec9104aa33a45b69950753db

SHA512
9d968fa0bafe95f9eb4ec37ae83718da22c99380932ad5453e4275385da3099405955e919d8391ef5671445b670c68e7a0cdcef5fb239cc5fbe378267f5d27de

Download Submit
C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe

Filesize
960KB

MD5
79313a0beb90d6f9ddbc2d3dafc0b5db

SHA1
8a23e431d43bd47c25b4fb6900cb71c6da1223e6

SHA256
3940d10f3527409df76e379938e9b83391e52417cd576c684e05d464629d8bce

SHA512
70a26143b9539d614eecb05d656229270a8f4e83ba6c771d3f7fe3ae1c937efaf5142cc57debaa13d61370ebd6034140921952fed4a23bcf5471a02404b7adf2

Download Submit
C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe

Filesize
1.2MB

MD5
f10ed1c4571be0dee2a9f146fef63bc0

SHA1
fab24d6b80796fd8bc3d8fec05c1baa2083409ca

SHA256
462138bb0fda9a2541b1eff44eec2b1c6b28f236fc5aef00a533bf24fbd560c0

SHA512
ebb37d72e0547f43a85e220daca7742bacb3f684d5cf78442fe5265c622a042b668889af0390d6286672cef4c6373725f3a962b3a10e1037c376bbcaedc4cd54

Download Submit
C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe

Filesize
1.1MB

MD5
edb46e5aadb0180f93b3d1d97d154eb0

SHA1
d89ee2d546d7baf261c6ab9b71e64461d551b8d7

SHA256
e47127085c5aad69959e739422e7ea2d4cdcac57db5354da7a164d648db2b316

SHA512
8ec411d69855f57184c356737b5314088a1e0c4d04a22f5126c84a61dee264318bdf5edbb28018414e8b3f33a34b69582d05978aca599180bd72cb9470858d4e

Download Submit
C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe

Filesize
64KB

MD5
888577712e89356d59db8b8a230d57bf

SHA1
d2217c5c97df4a270ec710d497de61933a127f15

SHA256
3eba73398e505805816dd08b00aa83a3e19fe1efc067e7488d3910de2cdeb4cc

SHA512
cc47ce222e90ed58d562e38b88090fe43ba44e2b183097c14625cf8c15141d076868984d169e81e3b12c1be3d6af549fa5893c64b067ec2c592e75917beabb06

Download Submit
C:\Users\Admin\AppData\Local\Temp\a5f1126e-26d0-4d02-a506-3968bcd26a41

Filesize
20KB

MD5
c9ff7748d8fcef4cf84a5501e996a641

SHA1
02867e5010f62f97ebb0cfb32cb3ede9449fe0c9

SHA256
4d3f3194cb1133437aa69bb880c8cbb55ddf06ff61a88ca6c3f1bbfbfd35d988

SHA512
d36054499869a8f56ac8547ccd5455f1252c24e17d2b185955390b32da7e2a732ace4e0f30f9493fcc61425a2e31ed623465f998f41af69423ee0e3ed1483a73

Download Submit
C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe

Filesize
881KB

MD5
2adfc9d5f1ee6fe333baebba93022397

SHA1
904590123bde3eb2db8df1b7a77cebfc8105488e

SHA256
97d8138b2682874c8a17fd819caec601b86dbac30be7d8068d387d7ec022e2e7

SHA512
b0fc0c8418be50cb5989aadf7010b1ef590cf602c9ca011ab91e36a49d4788345a9be2c9b4bdd6d12f9fb84a6cae4e0a8c316c2320dca35061424d293928ad66

Download Submit
C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe

Filesize
722KB

MD5
52d9f1b269f2f2a887084cc6d9961e32

SHA1
134df0c0c167c5d7ba52cd0fd2b2c5b5de534618

SHA256
6e22c05fdf93d25d14333456057849dd99b90e1bb74b52161eb12092e5a062d7

SHA512
04233a6e44c535675dac07fce38f52f2ce35d4ff3c6fc49841c898039887b52b68711d545ffebc691ed31d0177b65ec2a44777e8362c4a202d325b320cb13fee

Download Submit
C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe

Filesize
320KB

MD5
5a22239dec1ae97e42cad84dfdcc44d1

SHA1
4c9a5dea61f734326099a5ee123ddb23316f2848

SHA256
d2124803935fe94cfa8472e0bd02f983c75b6b54c6551bee1d04b72ff800d81e

SHA512
1af57e347e930eadf82f5491d598d979e7173d4c110a35721c67f0fb7d37c0e1f1ac96c433aa5f5a3a8d09be47019aec1d3377b86495215b809ed8df7836d01f

Download Submit
C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe

Filesize
1.0MB

MD5
bff57b9ab984ddde6fe92a48ddfafe27

SHA1
5604daf96bb4cf38045a25dd17c49e8163d5c0d2

SHA256
b012843ac33c8db17b60854519cc056996337b53a705d52af516d96365325440

SHA512
e15bfe1f32c7a07848bce657b2e9f3e1f93abf2f79315aacf9bcf0c0e18f9fcd636dae2af437a6a276fcade6a0c0e375e80d6e5640dae5bc9e99d5f4da8ba19b

Download Submit
C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe

Filesize
1.1MB

MD5
3004633734fea05cb9af3b3821d4caa3

SHA1
31a797474d43382285085ce073901978abd8be55

SHA256
0a32d10f8e4446e256ba51f5d621b3a1989452c4d652b5973f201721f0d0f6f3

SHA512
a2f5752ff669eff8bb0d95c0921b8ac742064f9df1d00dd207d55149d5be86a37850ba355470273fb41201cc349c3e7497fd9648ed9242a46e75b2e6a4c213d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\dxwebsetup.exe

Filesize
1.3MB

MD5
aeb1c37a4803a9bebe5c93de3ac4b4d2

SHA1
459b8725067a12d2e109a7e7c7c2278f33dd4932

SHA256
4c8b442458a558bbfba150a8e0bfceb46df06b99f210fd45438c04510b1c6946

SHA512
cabad8251823a5869fb4823701863655810eff03a455d3d784c6829c78855094263ab4d0b97dc41c8b5c0194485bf0426e467e4e977c9242d7cd122d79236849

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp96BD.tmp.dat

Filesize
92KB

MD5
4c2e2189b87f507edc2e72d7d55583a0

SHA1
1f06e340f76d41ea0d1e8560acd380a901b2a5bd

SHA256
99a5f8dea08b5cf512ed888b3e533cc77c08dc644078793dc870abd8828c1bca

SHA512
8b6b49e55afe8a697aaf71d975fab9e906143339827f75a57876a540d0d7b9e3cbbcdd8b5435d6198900a73895cc52d2082e66ee8cec342e72f2e427dde71600

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp96DD.tmp.dat

Filesize
46KB

MD5
02d2c46697e3714e49f46b680b9a6b83

SHA1
84f98b56d49f01e9b6b76a4e21accf64fd319140

SHA256
522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9

SHA512
60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp96DE.tmp.dat

Filesize
122KB

MD5
04df6b46d7a32e6e9fbeacb54a3e7c38

SHA1
85a98717c32a1ef45eecb5d9a65590e0797b221c

SHA256
4e978774109e20ca98fcb02142474fd21ba6af7b19efc5f5d7b497db7010e6dd

SHA512
1b821ffdd8b35b860e47935f83a9978877f76912f45f6cd4ae065a2b0a49295b6f6625c96a8af7658bf058951633d90e5b2f99fbc0e276eb1905990a014aa87b

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp96EF.tmp.tmpdb

Filesize
206KB

MD5
5faa5034cc1fafa5019f77982b2c8dca

SHA1
80adadae86ba7b2c80b2ec924cf6221e76b109fa

SHA256
781eae4e5ccc37e7447a108f6e42431cbc30194cbfcbd62a192cc082d5175d43

SHA512
9b5960e0d0866e1716bdd4c925b48093e007e0f925bb03a2028a547bdd7a0e1b483756fc93c78cc0a8aef9cd226d293d29d21d630dcb8445accf8178e66961d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp970F.tmp.tmpdb

Filesize
96KB

MD5
d367ddfda80fdcf578726bc3b0bc3e3c

SHA1
23fcd5e4e0e5e296bee7e5224a8404ecd92cf671

SHA256
0b8607fdf72f3e651a2a8b0ac7be171b4cb44909d76bb8d6c47393b8ea3d84a0

SHA512
40e9239e3f084b4b981431817ca282feb986cf49227911bf3d68845baf2ee626b564c8fabe6e13b97e6eb214da1c02ca09a62bcf5e837900160cf479c104bf77

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp97CE.tmp.dat

Filesize
76KB

MD5
afeface3dfea913bf00d720523341230

SHA1
f63215abbee8028dc319f7fe6e22669a19710a02

SHA256
8d9b39209e09240ccfc756cc876e34f1d1db233c89ba7b8bbfe5e3b63c642191

SHA512
4e627ca47425491bdf589668d921548c2fe59089e17dfc1337b9c2edef3aacfd21dae54b1516050584b7d9b755c5a8c27d3c566a8ab00076138b382cc0fca192

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpB960.tmp.dat

Filesize
56KB

MD5
d444c807029c83b8a892ac0c4971f955

SHA1
fa58ce7588513519dc8fed939b26b05dc25e53b5

SHA256
8297a7698f19bb81539a18363db100c55e357fa73f773c2b883d2c4161f6a259

SHA512
b7958b843639d4223bef65cdc6c664d7d15b76ac4e0a8b1575201dd47a32899feff32389dcc047314f47944ebe7b774cd59e51d49202f49541bbd70ecbb31a2e

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpB961.tmp.dat

Filesize
192KB

MD5
8ccb6c13863fb6e99ed9a29a95f273fe

SHA1
b809aadcbd64fc29edb0cf27fb223784563a911f

SHA256
6b5e07d7137e1d3bee13888a7e8c81fae36ef046c9c7ba074e5fef67e6a594b4

SHA512
635bd5e4a1f9c0bf4dd331912f47d65de52496ae4e8fd8de84fac2008064c5c07b60fc33dd318cdf091ad9de2d14a0ff326a95d14f8084f0e5abbcaa98c7f0bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\v2.exe

Filesize
271KB

MD5
836107386d4a2c6a84c945496556118b

SHA1
5677a4455f5697dba4e9e17a48ca0f02985455f9

SHA256
62b92015e99f9162a9a6a11edcf136ab43d30fbd82cbc47b0f40630daad8e028

SHA512
19a7efe2348366042463ad93d556d66aa24506a5df661e11f503ea07d736a34416fe8f7354f21b78c49d1a6915a6fced2b9856e0493240968bbe5effa1337c87

Download Submit
C:\Users\Admin\AppData\Roaming\BRFRDXwwPuHVRLVDPROAILVCNY.Admin\Process.txt

Filesize
731B

MD5
e2a2b3d61d2808aeaf897c35e2701830

SHA1
83b7281c929b151bb8d2f8a4c64802bc4c734e6e

SHA256
24da4150a1d711af2db32190d177985f7ac200ff75f2072516073ba9259ea517

SHA512
d2a84c699bc4e5b75d6032f34a4795a340753c17c17a7797c8ea4c7cfa3180607e19a59118094acc4f0514b37e44e217021047242fdc31664cab881dd4ee83d2

Download Submit
C:\Users\Admin\AppData\Roaming\BRFRDXwwPuHVRLVDPROAILVCNY.Admin\Process.txt

Filesize
1KB

MD5
39f45af3aa1c2e42888e6eacae0f0020

SHA1
c02ef5611473949c1e0ac5e74c6a57c24bb17e31

SHA256
c80dccd9436d571fcc5d2775927199bdb56488a853a45787db61a0ed59071138

SHA512
0ba28858229d7ac5704e28c63ebb7db2b3daf52f895197dc36a196134b63bdc28a9fabaa2055a695a42af69b0b3893d738be2dd7ff68bf909e4ad61995838618

Download Submit
C:\Users\Admin\AppData\Roaming\LTyZNHFRBOAILVCNY.Admin\Files\DenyMeasure.txt

Filesize
2.1MB

MD5
b5e4cc16eb7a831e7a6116aca6e71166

SHA1
d31cfa60442ce575be88e9caf3c7a5ed574382fe

SHA256
1efecb3a3ac29820a6fa1f28e8999805b5e244c22d50733520700caa839c69d7

SHA512
dfe8751eae2ff181c414ec483f4e88a16d695137d2133a41ab822ae170bdf03a53264a407affe20650890f04236adcbd5304e967a53c6080da70310437627360

Download Submit
C:\Users\Admin\AppData\Roaming\LTyZNHFRBOAILVCNY.Admin\Process.txt

Filesize
1KB

MD5
3c63bc86158876c1449bc2daaf376354

SHA1
d5c5319390c831c526d899754288c4dd8c4dbb95

SHA256
5ff4f480f96ddd675d36c40817107ee1ff5f9d072eef0f16bf4cc32e44c13cbb

SHA512
c451a6c756b714c7c27f0fb729024a0e2cea69df5e7fa2b8497327c1114fb32dc37f384aadb9a622b8f99f9cb0d3d4c30e5af63ad0169237929bb8771e7ef511

Download Submit
C:\Users\Admin\AppData\Roaming\LTyZNHFRBOAILVCNY.Admin\Screen.png

Filesize
426KB

MD5
cfcd984f4667c820d9d153ebb52d362c

SHA1
28280ef81c88758a5d6d7ced61013562df046f9c

SHA256
d4d022fe9c11bbf85b0dd5204187a4aac6d5ad21342407e7be98aca9b72ab59f

SHA512
ccdc5340fa3476225dfa10cde93b70cf5e643919cbecb8710ace4fffb8c954b613a8b629d994f1cdb8a3b35b2f17924d4334e42c1be05dbc5e053c2e509354b7

Download Submit
C:\Users\Admin\AppData\Roaming\LwBRLwLRwPwRZNTRHOAILVCNY.Admin\Process.txt

Filesize
1KB

MD5
4dd8efb5705caae6bc9546d1b5557b14

SHA1
39e7232047c67df5c0d2f6e3ae96ebeb07220d58

SHA256
86e42479275578a915696b63f295919c52244beb1d7caeb2a0db6bc4e367de2c

SHA512
42e3a522561a959434215901e8a4542caf62b0968a0c66a0cd480b65b2b7abfc670af1b37d67a7fda16a595fd74d6943aa5f70fa9798e4251cf15aa3a02746bd

Download Submit
C:\Users\Admin\AppData\Roaming\NHPPZHJDVPBLVVXwyXuyPHyyuOAILVCNY.Admin\Process.txt

Filesize
1KB

MD5
f71b83f15c79930c362b819e331667b1

SHA1
6bf9d1d4804cebb289c1e8ade548f723a01b3e2a

SHA256
6aba3119a6ff6500ef3baf794df81dd4a9611bb7066ab91bb99fe883778c2ca0

SHA512
34034fb2b0e437817d6a4efd19a5fa5206a65974ae1de918de253e6cf3e7ad4ba9232a0a9ac9b7e68193f1cba303302ba318e918e69bb8756cc48d035c43b2a2

Download Submit
C:\Users\Admin\AppData\Roaming\PFOAILVCNY.Admin\Process.txt

Filesize
1KB

MD5
fb5d08193a32853c470e925b655dd1ac

SHA1
1b90fd8ca66b849164b6af9d46a7028d79cbe1ff

SHA256
1576910beafe1361de9afc0d81bbe9b620097c080f3d4db6c288925643a85096

SHA512
bf816731274939234500a34a74aa9873a7fd562a35839b96c8d20b753d79afb596616c407f1ce1cabfa71756c516cb44d625041214e17051320e3a7d5079d33f

Download Submit
C:\Users\Admin\AppData\Roaming\PTHRLFBOAILVCNY.Admin\Process.txt

Filesize
718B

MD5
d961e1a0515e39639c84abc14ed5f3b3

SHA1
72012987ddba6b450f85290ef650c63dccd6cae6

SHA256
365b739cea9adfbf8cf94caa6da4e1ae45329e00f282d292add34d24ab5ca6fe

SHA512
823496bbba917dd2ae60f4fd506d9d08446efc7751835ed30fb78331ee379bd292e2792c7267b66af7072f997eb892eb127551d4b959342fe3615f116d8d501d

Download Submit
C:\Users\Admin\AppData\Roaming\PTHRLFBOAILVCNY.Admin\Process.txt

Filesize
1KB

MD5
d6404c00b2565b55e342050acd950f24

SHA1
eaafa4548e0149a39b88fbfa082892abef0e74a7

SHA256
f33d3e69347a910238ab8c238f60079d5490f7302774907d22ee71cddbf95dd4

SHA512
c62dd7f8dcc9e50b81c335ad43c0b93c4bc11e0a71475f6c31a41c2de3f60544cba906c42403a874ff141c7359764e6d0794642fc39128b29d33e0bb58e9edd1

Download Submit
C:\Users\Admin\AppData\Roaming\PwNXuPDDZDBuXDNZJOAILVCNY.Admin\Process.txt

Filesize
1KB

MD5
833116935691ea820e63fa97fc221e31

SHA1
80533eb2b5455b613fc3ca705645c94b5b7c8474

SHA256
ff912c32d7ced98364e0535da9589942a4fa9eb9549a4f2f6e80ac7f4e132117

SHA512
299a75e37d2a3fead4a05b2a272a5d7d82e05f86aa907c4c633e760f020fc5bdb105e4bb9beb3a36f3cfe4841fc2f358064edbf8ac9696a91b8be3bb43f57dc3

Download Submit
C:\Users\Admin\AppData\Roaming\VHTTFTXJTuFHXDOAILVCNY.Admin\Process.txt

Filesize
1KB

MD5
8cfce0bed6fbdf536d7a79cdd8a4bd44

SHA1
26d4a464a8112aaa7e190cf685da078de883c2ee

SHA256
061c37161694aeaa9573caf68822ee9da7fc5fea85a51cecaad5b0be13652e6a

SHA512
50caa884da1c36ff21a7813d66167651e98f08b6135a44fa01a3675e6596fb4647cf230dc9bd7df8caf3e2a61326a6e9f29f7978f66c32c6c763fb845d8c66a4

Download Submit
C:\Users\Admin\AppData\Roaming\VuRRRuNwOAILVCNY.Admin\Process.txt

Filesize
1KB

MD5
d30a70bc3b57e7610f91a8207c2e0846

SHA1
d4b8374c5f1265b03d82173c64732b6a464cc995

SHA256
d52d4f5ad32103402282fba6c7c5751cc21011c61a9a168e576ac4dece0b1277

SHA512
41b25a3dad613107176a1be2b7563f79758dbcc89de60835770d07c01722092cedf81fb0b74c0ad4de27242b4d4b8581102104c99ad2703bfdbab7a35915d212

Download Submit
C:\Users\Admin\AppData\Roaming\VuRRRuNwOAILVCNY.Admin\Process.txt

Filesize
1KB

MD5
a47450a02e9ae74bc64c5f659cd98613

SHA1
1445fcd8ba7b3dabc5f15acb030fda5c889498cc

SHA256
f278c5e7a35feb26549e25fae3e3e45cab173933983a2b021cc29f6faa8ed30a

SHA512
dd2133fe6b362b87b9078473659463a333c104c11e2578cfee0cd839e5b96e899401324588be6328b16db74cb7361a1462762e0b298ccebb2ea1297980b705a7

Download Submit
C:\Users\Admin\AppData\Roaming\ZRuOAILVCNY.Admin\Browsers\Firefox\Bookmarks.txt

Filesize
105B

MD5
2e9d094dda5cdc3ce6519f75943a4ff4

SHA1
5d989b4ac8b699781681fe75ed9ef98191a5096c

SHA256
c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142

SHA512
d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7

Download Submit
C:\Users\Admin\AppData\Roaming\ZRuOAILVCNY.Admin\Process.txt

Filesize
1KB

MD5
389bdfb87a835eac64bc2008f0d9eaa3

SHA1
5bc8bdd46b9b818557aaae1e5a01ce131df18281

SHA256
059088ca2b2c9b4a76cab022baebf44492b342ce588d8af9ed0ae4ec467edb7e

SHA512
5e2c5d136f6ea3ed87e5212ccd73f0808de9e0b4e5452207e4bee23eb710ec107ff8c3db9e3c9565b5eb48acdea8317b2b4c164a172667b3cff386a3e290e00a

Download Submit
C:\Users\Admin\AppData\Roaming\uRNJuBRXuBwJHDOAILVCNY.Admin\Process.txt

Filesize
1KB

MD5
9ae5b486b10cae2535d7055cd2b9ac49

SHA1
d351f0eeafb3c545fb1dae73aef4e034789493fa

SHA256
d5e50bb4feb5a10d5c299ac86ec18e0a663068cc438a39f1790eafb73fa27fbd

SHA512
a384fca392b1ba84688dd35f726f7858b265cf9631658b47a9820f9a4d8f5fe46b4232a83bcfadc5b39785bcd9254cee1d3592e7812507aff61efa29b71daf60

Download Submit
C:\Users\Admin\AppData\Roaming\wFyVVLZRTJJJHwTLHDZVZBOAILVCNY.Admin\Process.txt

Filesize
1KB

MD5
133d2c8036b9b164c3600bf5712d391c

SHA1
1c629a3aca4cb548a284f09d374a3943a182e3a0

SHA256
574c307bac1be8d1b0164c4f953c0e0e14696e78d4fa6dfc3a56e347181cf01f

SHA512
33a5835196b1882d83fb806e6192d3e4bae2fe5c2e887383b4580832399e2325e037c84d268834032668be187d8c08e1d0207626322e00af3e77f5e50f99f80a

Download Submit
C:\Users\Admin\AppData\Roaming\wXHPZPJHHVVFRHRXRDRZVOAILVCNY.Admin\Process.txt

Filesize
1KB

MD5
2a2694061a7f43b270c01380728955c5

SHA1
ad70028a816d8296ab1da4ccea23480a2cef2a55

SHA256
9bf6262392ec2d0e2e5a1e9e99df08914ba6ebf4aa0f60d81e608a0397458003

SHA512
296b0681d75b58ba1d328fabcee16889ad33d4f4cb5805667c9146229bef4c128ce612fb548021513d646e797bffa9891dc9ce5afb4d2113c33eca977b39af6c

Download Submit
C:\Users\Admin\AppData\Roaming\yBJNTHyHDXLOAILVCNY.Admin\Process.txt

Filesize
1KB

MD5
32f138796a5b642eadd691188dca86c4

SHA1
e2c65cbe71bd29d1271fefd975dbbb31191839e7

SHA256
5c1935cb3ae8e2186242cf27b604386a694498a63a39909c46148b57dd0913d0

SHA512
ff65b0c1ebfb1f001ebcb09388d2a84abce00ed9a8fedec19781c3e7f031709d81b5efbe30e6326891e8c1215179dc24faf2ee7ab1bb1eea14d834771cc6bbb1

Download Submit
C:\Users\Admin\AppData\Roaming\yOAILVCNY.Admin\Process.txt

Filesize
1KB

MD5
a2c28aadf681d9c8c59b7d52b7c69abd

SHA1
96acc6abb0a785b1bc11cfd45fd7265e25e7c385

SHA256
aca9bacc81757fb2873c1f718e5f37847de6ba9f57b66ef719349a36089f8aaa

SHA512
e5e8279e3f50aa5eefd351cdbeb0810877b61571ce5dff874a8aa0d9d1f9863abbe65f1f5197b1f762c6450c301bea1a324e7c7bc649f057ac0145df6609f621

Download Submit
C:\Users\Admin\AppData\Roaming\yZwHJFZFDJLJJXOAILVCNY.Admin\Process.txt

Filesize
1KB

MD5
9acf21f0b37e43f2f0ad0395ad73c550

SHA1
d55dae3a8b0650e7cb27b6946b38cee869e263ad

SHA256
b34a1085159a2c21a827a0ce4523eda095ceaefca558bdfbe56916463292aa04

SHA512
85756ed8b7b36b961588b37271443dd8f7deb270a192fbc0dcabf8ca5da301756e31138382acf173a4c62d77c6891c74453ccfec9f1a99aede4415b7eb4861a2

Download Submit
memory/348-137-0x00000000731F0000-0x00000000739A0000-memory.dmp

Filesize
7.7MB

Download
memory/348-85-0x0000000000F70000-0x0000000000FBA000-memory.dmp

Filesize
296KB

Download
memory/348-116-0x00000000058F0000-0x0000000005900000-memory.dmp

Filesize
64KB

Download
memory/348-79-0x00000000731F0000-0x00000000739A0000-memory.dmp

Filesize
7.7MB

Download
memory/1084-442-0x0000000073210000-0x00000000739C0000-memory.dmp

Filesize
7.7MB

Download
memory/1084-480-0x0000000073210000-0x00000000739C0000-memory.dmp

Filesize
7.7MB

Download
memory/1084-448-0x0000000004D70000-0x0000000004D80000-memory.dmp

Filesize
64KB

Download
memory/1512-301-0x0000000073210000-0x00000000739C0000-memory.dmp

Filesize
7.7MB

Download
memory/1512-279-0x0000000073210000-0x00000000739C0000-memory.dmp

Filesize
7.7MB

Download
memory/1512-287-0x0000000001170000-0x0000000001180000-memory.dmp

Filesize
64KB

Download
memory/1660-587-0x0000000006AE0000-0x0000000006B2C000-memory.dmp

Filesize
304KB

Download
memory/1660-584-0x0000000006780000-0x0000000006AD4000-memory.dmp

Filesize
3.3MB

Download
memory/1660-528-0x0000000073210000-0x00000000739C0000-memory.dmp

Filesize
7.7MB

Download
memory/1660-529-0x00000000054B0000-0x00000000054C0000-memory.dmp

Filesize
64KB

Download
memory/1660-598-0x0000000006B80000-0x0000000006BA1000-memory.dmp

Filesize
132KB

Download
memory/1868-434-0x0000000005660000-0x0000000005670000-memory.dmp

Filesize
64KB

Download
memory/1868-439-0x0000000073210000-0x00000000739C0000-memory.dmp

Filesize
7.7MB

Download
memory/1868-343-0x0000000073210000-0x00000000739C0000-memory.dmp

Filesize
7.7MB

Download
memory/1968-474-0x0000000073210000-0x00000000739C0000-memory.dmp

Filesize
7.7MB

Download
memory/1968-468-0x0000000004B70000-0x0000000004B80000-memory.dmp

Filesize
64KB

Download
memory/1968-466-0x0000000073210000-0x00000000739C0000-memory.dmp

Filesize
7.7MB

Download
memory/2908-288-0x0000000005E30000-0x0000000006184000-memory.dmp

Filesize
3.3MB

Download
memory/2908-282-0x0000000005DC0000-0x0000000005E28000-memory.dmp

Filesize
416KB

Download
memory/2908-214-0x0000000073210000-0x00000000739C0000-memory.dmp

Filesize
7.7MB

Download
memory/2908-518-0x0000000073210000-0x00000000739C0000-memory.dmp

Filesize
7.7MB

Download
memory/2908-228-0x0000000004D20000-0x0000000004D30000-memory.dmp

Filesize
64KB

Download
memory/2908-223-0x0000000005550000-0x00000000055E2000-memory.dmp

Filesize
584KB

Download
memory/2908-499-0x0000000006540000-0x000000000655E000-memory.dmp

Filesize
120KB

Download
memory/2908-242-0x00000000052D0000-0x0000000005362000-memory.dmp

Filesize
584KB

Download
memory/2908-273-0x00000000050F0000-0x0000000005140000-memory.dmp

Filesize
320KB

Download
memory/2908-486-0x0000000007890000-0x0000000007906000-memory.dmp

Filesize
472KB

Download
memory/2908-276-0x00000000054F0000-0x0000000005512000-memory.dmp

Filesize
136KB

Download
memory/2908-306-0x0000000004CE0000-0x0000000004D01000-memory.dmp

Filesize
132KB

Download
memory/2908-291-0x00000000063D0000-0x000000000641C000-memory.dmp

Filesize
304KB

Download
memory/2908-467-0x0000000004D20000-0x0000000004D30000-memory.dmp

Filesize
64KB

Download
memory/2908-465-0x0000000073210000-0x00000000739C0000-memory.dmp

Filesize
7.7MB

Download
memory/2908-302-0x00000000075E0000-0x000000000761C000-memory.dmp

Filesize
240KB

Download
memory/2908-298-0x0000000006680000-0x0000000006842000-memory.dmp

Filesize
1.8MB

Download
memory/2908-431-0x0000000007820000-0x0000000007886000-memory.dmp

Filesize
408KB

Download
memory/2908-319-0x0000000007BD0000-0x0000000008174000-memory.dmp

Filesize
5.6MB

Download
memory/4020-608-0x0000000073210000-0x00000000739C0000-memory.dmp

Filesize
7.7MB

Download
memory/4020-593-0x0000000004F40000-0x0000000004F50000-memory.dmp

Filesize
64KB

Download
memory/4020-592-0x0000000073210000-0x00000000739C0000-memory.dmp

Filesize
7.7MB

Download
memory/4408-477-0x0000000004A60000-0x0000000004A70000-memory.dmp

Filesize
64KB

Download
memory/4408-471-0x0000000073210000-0x00000000739C0000-memory.dmp

Filesize
7.7MB

Download
memory/4408-483-0x0000000073210000-0x00000000739C0000-memory.dmp

Filesize
7.7MB

Download
memory/4484-160-0x0000000005000000-0x0000000005010000-memory.dmp

Filesize
64KB

Download
memory/4484-146-0x0000000073320000-0x0000000073AD0000-memory.dmp

Filesize
7.7MB

Download
memory/4484-172-0x0000000073320000-0x0000000073AD0000-memory.dmp

Filesize
7.7MB

Download
memory/4504-523-0x0000000073210000-0x00000000739C0000-memory.dmp

Filesize
7.7MB

Download
memory/4504-512-0x0000000073210000-0x00000000739C0000-memory.dmp

Filesize
7.7MB

Download
memory/4504-515-0x0000000005720000-0x0000000005730000-memory.dmp

Filesize
64KB

Download
memory/4548-305-0x0000000073210000-0x00000000739C0000-memory.dmp

Filesize
7.7MB

Download
memory/4548-309-0x0000000004BD0000-0x0000000004BE0000-memory.dmp

Filesize
64KB

Download
memory/4548-320-0x0000000073210000-0x00000000739C0000-memory.dmp

Filesize
7.7MB

Download
memory/4556-171-0x0000000073320000-0x0000000073AD0000-memory.dmp

Filesize
7.7MB

Download
memory/4556-156-0x0000000005660000-0x0000000005670000-memory.dmp

Filesize
64KB

Download
memory/4556-142-0x0000000073320000-0x0000000073AD0000-memory.dmp

Filesize
7.7MB

Download
memory/4560-136-0x00000000731F0000-0x00000000739A0000-memory.dmp

Filesize
7.7MB

Download
memory/4560-120-0x0000000004960000-0x0000000004970000-memory.dmp

Filesize
64KB

Download
memory/4560-81-0x00000000731F0000-0x00000000739A0000-memory.dmp

Filesize
7.7MB

Download
memory/4820-496-0x0000000004C80000-0x0000000004C90000-memory.dmp

Filesize
64KB

Download
memory/4820-493-0x0000000073210000-0x00000000739C0000-memory.dmp

Filesize
7.7MB

Download
memory/4820-502-0x0000000073210000-0x00000000739C0000-memory.dmp

Filesize
7.7MB

Download