Overview

overview

10

Static

static

10

Client-built.exe

windows7-x64

10

Client-built.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    1050s
  • max time network
    1053s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/04/2024, 20:13

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Client-built.exe
  • Size 3.1MB
  • Sample240425-yzm5faeb21
  • SHA256 733436d5bc6464c09757584b8609fa28898f2622412e55421ebdab550e02e4ea
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
quasaroffice04spywaretrojan

Malware Config

Extracted

Family

  • quasar

Version

  • 1.4.1

Botnet

  • Office04

C2

  • ZE:4782

Mutex

  • 911e182a-c76f-4c94-979c-4ba6b3b24941

Attributes
  • encryption_key

    EFF71D9D44DB5A6D9B14E191FC8CC16A1F4043B2

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Quasar Client Startup

  • subdirectory

    SubDir

Signatures

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar
  • Quasar payload 1 IoCs
  • Checks computer location settings 2 TTPs 64 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops desktop.ini file(s) 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 1 IoCs
  • Runs ping.exe 1 TTPs 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Client-built.exe
    "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1184
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\WW2zOQi6QB96.bat" "
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3880
      • C:\Windows\system32\chcp.com
        chcp 65001
        3⤵
          PID:3324
        • C:\Windows\system32\PING.EXE
          ping -n 10 localhost
          3⤵
          • Runs ping.exe
          PID:1192
        • C:\Users\Admin\AppData\Local\Temp\Client-built.exe
          "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
          3⤵
          • Checks computer location settings
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:4452
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Rt5932FRUbXB.bat" "
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:4604
            • C:\Windows\system32\chcp.com
              chcp 65001
              5⤵
                PID:2092
              • C:\Windows\system32\PING.EXE
                ping -n 10 localhost
                5⤵
                • Runs ping.exe
                PID:4144
              • C:\Users\Admin\AppData\Local\Temp\Client-built.exe
                "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
                5⤵
                • Checks computer location settings
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SendNotifyMessage
                • Suspicious use of SetWindowsHookEx
                • Suspicious use of WriteProcessMemory
                PID:1788
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mCRtil6Xfmob.bat" "
                  6⤵
                  • Suspicious use of WriteProcessMemory
                  PID:2320
                  • C:\Windows\system32\chcp.com
                    chcp 65001
                    7⤵
                      PID:4800
                    • C:\Windows\system32\PING.EXE
                      ping -n 10 localhost
                      7⤵
                      • Runs ping.exe
                      PID:5024
                    • C:\Users\Admin\AppData\Local\Temp\Client-built.exe
                      "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
                      7⤵
                      • Checks computer location settings
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of FindShellTrayWindow
                      • Suspicious use of SendNotifyMessage
                      • Suspicious use of SetWindowsHookEx
                      • Suspicious use of WriteProcessMemory
                      PID:3636
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\h9QGwYgYdBak.bat" "
                        8⤵
                        • Suspicious use of WriteProcessMemory
                        PID:2724
                        • C:\Windows\system32\chcp.com
                          chcp 65001
                          9⤵
                            PID:224
                          • C:\Windows\system32\PING.EXE
                            ping -n 10 localhost
                            9⤵
                            • Runs ping.exe
                            PID:1220
                          • C:\Users\Admin\AppData\Local\Temp\Client-built.exe
                            "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
                            9⤵
                            • Checks computer location settings
                            • Suspicious use of AdjustPrivilegeToken
                            • Suspicious use of FindShellTrayWindow
                            • Suspicious use of SendNotifyMessage
                            • Suspicious use of SetWindowsHookEx
                            • Suspicious use of WriteProcessMemory
                            PID:2572
                            • C:\Windows\system32\cmd.exe
                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TYDzRPnIvhKv.bat" "
                              10⤵
                              • Suspicious use of WriteProcessMemory
                              PID:1596
                              • C:\Windows\system32\chcp.com
                                chcp 65001
                                11⤵
                                  PID:4352
                                • C:\Windows\system32\PING.EXE
                                  ping -n 10 localhost
                                  11⤵
                                  • Runs ping.exe
                                  PID:3740
                                • C:\Users\Admin\AppData\Local\Temp\Client-built.exe
                                  "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
                                  11⤵
                                  • Checks computer location settings
                                  • Suspicious use of AdjustPrivilegeToken
                                  • Suspicious use of FindShellTrayWindow
                                  • Suspicious use of SendNotifyMessage
                                  • Suspicious use of SetWindowsHookEx
                                  • Suspicious use of WriteProcessMemory
                                  PID:5092
                                  • C:\Windows\system32\cmd.exe
                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\N0YekqzEJnLI.bat" "
                                    12⤵
                                    • Suspicious use of WriteProcessMemory
                                    PID:4608
                                    • C:\Windows\system32\chcp.com
                                      chcp 65001
                                      13⤵
                                        PID:2324
                                      • C:\Windows\system32\PING.EXE
                                        ping -n 10 localhost
                                        13⤵
                                          PID:4952
                                        • C:\Users\Admin\AppData\Local\Temp\Client-built.exe
                                          "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
                                          13⤵
                                          • Checks computer location settings
                                          • Suspicious use of AdjustPrivilegeToken
                                          • Suspicious use of FindShellTrayWindow
                                          • Suspicious use of SendNotifyMessage
                                          • Suspicious use of SetWindowsHookEx
                                          • Suspicious use of WriteProcessMemory
                                          PID:3004
                                          • C:\Windows\system32\cmd.exe
                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\4oMu7VMdEqvC.bat" "
                                            14⤵
                                            • Suspicious use of WriteProcessMemory
                                            PID:2504
                                            • C:\Windows\system32\chcp.com
                                              chcp 65001
                                              15⤵
                                                PID:3084
                                              • C:\Windows\system32\PING.EXE
                                                ping -n 10 localhost
                                                15⤵
                                                • Runs ping.exe
                                                PID:220
                                              • C:\Users\Admin\AppData\Local\Temp\Client-built.exe
                                                "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
                                                15⤵
                                                • Checks computer location settings
                                                • Suspicious use of AdjustPrivilegeToken
                                                • Suspicious use of FindShellTrayWindow
                                                • Suspicious use of SendNotifyMessage
                                                • Suspicious use of SetWindowsHookEx
                                                • Suspicious use of WriteProcessMemory
                                                PID:3344
                                                • C:\Windows\system32\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\1jFHetSnAER3.bat" "
                                                  16⤵
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:904
                                                  • C:\Windows\system32\chcp.com
                                                    chcp 65001
                                                    17⤵
                                                      PID:3888
                                                    • C:\Windows\system32\PING.EXE
                                                      ping -n 10 localhost
                                                      17⤵
                                                      • Runs ping.exe
                                                      PID:3320
                                                    • C:\Users\Admin\AppData\Local\Temp\Client-built.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
                                                      17⤵
                                                      • Checks computer location settings
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      • Suspicious use of FindShellTrayWindow
                                                      • Suspicious use of SendNotifyMessage
                                                      • Suspicious use of SetWindowsHookEx
                                                      PID:4464
                                                      • C:\Windows\system32\cmd.exe
                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\xOtDNvfNHVrx.bat" "
                                                        18⤵
                                                          PID:3368
                                                          • C:\Windows\system32\chcp.com
                                                            chcp 65001
                                                            19⤵
                                                              PID:1996
                                                            • C:\Windows\system32\PING.EXE
                                                              ping -n 10 localhost
                                                              19⤵
                                                              • Runs ping.exe
                                                              PID:3984
                                                            • C:\Users\Admin\AppData\Local\Temp\Client-built.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
                                                              19⤵
                                                              • Checks computer location settings
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              • Suspicious use of FindShellTrayWindow
                                                              • Suspicious use of SendNotifyMessage
                                                              • Suspicious use of SetWindowsHookEx
                                                              PID:1144
                                                              • C:\Windows\system32\cmd.exe
                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mP8YYnbq4lby.bat" "
                                                                20⤵
                                                                  PID:1712
                                                                  • C:\Windows\system32\chcp.com
                                                                    chcp 65001
                                                                    21⤵
                                                                      PID:1940
                                                                    • C:\Windows\system32\PING.EXE
                                                                      ping -n 10 localhost
                                                                      21⤵
                                                                        PID:1344
                                                                      • C:\Users\Admin\AppData\Local\Temp\Client-built.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
                                                                        21⤵
                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                        • Suspicious use of FindShellTrayWindow
                                                                        • Suspicious use of SendNotifyMessage
                                                                        • Suspicious use of SetWindowsHookEx
                                                                        PID:724
                                                                        • C:\Windows\system32\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Mb0CxXKrdcwe.bat" "
                                                                          22⤵
                                                                            PID:4652
                                                                            • C:\Windows\system32\chcp.com
                                                                              chcp 65001
                                                                              23⤵
                                                                                PID:4144
                                                                              • C:\Windows\system32\PING.EXE
                                                                                ping -n 10 localhost
                                                                                23⤵
                                                                                • Runs ping.exe
                                                                                PID:4504
                                                                              • C:\Users\Admin\AppData\Local\Temp\Client-built.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
                                                                                23⤵
                                                                                • Checks computer location settings
                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                • Suspicious use of FindShellTrayWindow
                                                                                • Suspicious use of SendNotifyMessage
                                                                                • Suspicious use of SetWindowsHookEx
                                                                                PID:1804
                                                                                • C:\Windows\system32\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\jF4kZADTTnJ6.bat" "
                                                                                  24⤵
                                                                                    PID:4184
                                                                                    • C:\Windows\system32\chcp.com
                                                                                      chcp 65001
                                                                                      25⤵
                                                                                        PID:3980
                                                                                      • C:\Windows\system32\PING.EXE
                                                                                        ping -n 10 localhost
                                                                                        25⤵
                                                                                        • Runs ping.exe
                                                                                        PID:3920
                                                                                      • C:\Users\Admin\AppData\Local\Temp\Client-built.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
                                                                                        25⤵
                                                                                        • Checks computer location settings
                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                        • Suspicious use of FindShellTrayWindow
                                                                                        • Suspicious use of SendNotifyMessage
                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                        PID:2376
                                                                                        • C:\Windows\system32\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sJ9jFYFStRlT.bat" "
                                                                                          26⤵
                                                                                            PID:4616
                                                                                            • C:\Windows\system32\chcp.com
                                                                                              chcp 65001
                                                                                              27⤵
                                                                                                PID:428
                                                                                              • C:\Windows\system32\PING.EXE
                                                                                                ping -n 10 localhost
                                                                                                27⤵
                                                                                                • Runs ping.exe
                                                                                                PID:5080
                                                                                              • C:\Users\Admin\AppData\Local\Temp\Client-built.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
                                                                                                27⤵
                                                                                                • Checks computer location settings
                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                • Suspicious use of FindShellTrayWindow
                                                                                                • Suspicious use of SendNotifyMessage
                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                PID:1288
                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\LIBUpMAy3Tzn.bat" "
                                                                                                  28⤵
                                                                                                    PID:1520
                                                                                                    • C:\Windows\system32\chcp.com
                                                                                                      chcp 65001
                                                                                                      29⤵
                                                                                                        PID:3928
                                                                                                      • C:\Windows\system32\PING.EXE
                                                                                                        ping -n 10 localhost
                                                                                                        29⤵
                                                                                                        • Runs ping.exe
                                                                                                        PID:648
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Client-built.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
                                                                                                        29⤵
                                                                                                        • Checks computer location settings
                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                        • Suspicious use of FindShellTrayWindow
                                                                                                        • Suspicious use of SendNotifyMessage
                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                        PID:2752
                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SBpWgsyA0lLC.bat" "
                                                                                                          30⤵
                                                                                                            PID:4452
                                                                                                            • C:\Windows\system32\chcp.com
                                                                                                              chcp 65001
                                                                                                              31⤵
                                                                                                                PID:1656
                                                                                                              • C:\Windows\system32\PING.EXE
                                                                                                                ping -n 10 localhost
                                                                                                                31⤵
                                                                                                                • Runs ping.exe
                                                                                                                PID:1104
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Client-built.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
                                                                                                                31⤵
                                                                                                                • Checks computer location settings
                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                • Suspicious use of FindShellTrayWindow
                                                                                                                • Suspicious use of SendNotifyMessage
                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                PID:1032
                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FiCVqewD5HKv.bat" "
                                                                                                                  32⤵
                                                                                                                    PID:2776
                                                                                                                    • C:\Windows\system32\chcp.com
                                                                                                                      chcp 65001
                                                                                                                      33⤵
                                                                                                                        PID:60
                                                                                                                      • C:\Windows\system32\PING.EXE
                                                                                                                        ping -n 10 localhost
                                                                                                                        33⤵
                                                                                                                        • Runs ping.exe
                                                                                                                        PID:2876
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Client-built.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
                                                                                                                        33⤵
                                                                                                                        • Checks computer location settings
                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                        • Suspicious use of FindShellTrayWindow
                                                                                                                        • Suspicious use of SendNotifyMessage
                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                        PID:4576
                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\AZo46z4yoQG5.bat" "
                                                                                                                          34⤵
                                                                                                                            PID:3508
                                                                                                                            • C:\Windows\system32\chcp.com
                                                                                                                              chcp 65001
                                                                                                                              35⤵
                                                                                                                                PID:928
                                                                                                                              • C:\Windows\system32\PING.EXE
                                                                                                                                ping -n 10 localhost
                                                                                                                                35⤵
                                                                                                                                • Runs ping.exe
                                                                                                                                PID:4584
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Client-built.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
                                                                                                                                35⤵
                                                                                                                                • Checks computer location settings
                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                • Suspicious use of FindShellTrayWindow
                                                                                                                                • Suspicious use of SendNotifyMessage
                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                PID:3188
                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\cu9cOxnxXGGc.bat" "
                                                                                                                                  36⤵
                                                                                                                                    PID:4564
                                                                                                                                    • C:\Windows\system32\chcp.com
                                                                                                                                      chcp 65001
                                                                                                                                      37⤵
                                                                                                                                        PID:4800
                                                                                                                                      • C:\Windows\system32\PING.EXE
                                                                                                                                        ping -n 10 localhost
                                                                                                                                        37⤵
                                                                                                                                        • Runs ping.exe
                                                                                                                                        PID:872
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Client-built.exe
                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
                                                                                                                                        37⤵
                                                                                                                                        • Checks computer location settings
                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                        • Suspicious use of FindShellTrayWindow
                                                                                                                                        • Suspicious use of SendNotifyMessage
                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                        PID:4268
                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\yAWGeFUoyA95.bat" "
                                                                                                                                          38⤵
                                                                                                                                            PID:2452
                                                                                                                                            • C:\Windows\system32\chcp.com
                                                                                                                                              chcp 65001
                                                                                                                                              39⤵
                                                                                                                                                PID:4436
                                                                                                                                              • C:\Windows\system32\PING.EXE
                                                                                                                                                ping -n 10 localhost
                                                                                                                                                39⤵
                                                                                                                                                  PID:2368
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Client-built.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
                                                                                                                                                  39⤵
                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                                                                                  • Suspicious use of SendNotifyMessage
                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                  PID:2092
                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\aNYuw594az7E.bat" "
                                                                                                                                                    40⤵
                                                                                                                                                      PID:2116
                                                                                                                                                      • C:\Windows\system32\chcp.com
                                                                                                                                                        chcp 65001
                                                                                                                                                        41⤵
                                                                                                                                                          PID:3204
                                                                                                                                                        • C:\Windows\system32\PING.EXE
                                                                                                                                                          ping -n 10 localhost
                                                                                                                                                          41⤵
                                                                                                                                                          • Runs ping.exe
                                                                                                                                                          PID:1124
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Client-built.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
                                                                                                                                                          41⤵
                                                                                                                                                          • Checks computer location settings
                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                                                                                          • Suspicious use of SendNotifyMessage
                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                          PID:5116
                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tbx557gRMZdF.bat" "
                                                                                                                                                            42⤵
                                                                                                                                                              PID:4304
                                                                                                                                                              • C:\Windows\system32\chcp.com
                                                                                                                                                                chcp 65001
                                                                                                                                                                43⤵
                                                                                                                                                                  PID:3184
                                                                                                                                                                • C:\Windows\system32\PING.EXE
                                                                                                                                                                  ping -n 10 localhost
                                                                                                                                                                  43⤵
                                                                                                                                                                  • Runs ping.exe
                                                                                                                                                                  PID:1520
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Client-built.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
                                                                                                                                                                  43⤵
                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                                                                                                  • Suspicious use of SendNotifyMessage
                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                  PID:4272
                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DZEfWEKvN6cD.bat" "
                                                                                                                                                                    44⤵
                                                                                                                                                                      PID:4048
                                                                                                                                                                      • C:\Windows\system32\chcp.com
                                                                                                                                                                        chcp 65001
                                                                                                                                                                        45⤵
                                                                                                                                                                          PID:3032
                                                                                                                                                                        • C:\Windows\system32\PING.EXE
                                                                                                                                                                          ping -n 10 localhost
                                                                                                                                                                          45⤵
                                                                                                                                                                          • Runs ping.exe
                                                                                                                                                                          PID:3368
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Client-built.exe
                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
                                                                                                                                                                          45⤵
                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                                                                                                          • Suspicious use of SendNotifyMessage
                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                          PID:2000
                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VLYVxW0vv82C.bat" "
                                                                                                                                                                            46⤵
                                                                                                                                                                              PID:3348
                                                                                                                                                                              • C:\Windows\system32\chcp.com
                                                                                                                                                                                chcp 65001
                                                                                                                                                                                47⤵
                                                                                                                                                                                  PID:3636
                                                                                                                                                                                • C:\Windows\system32\PING.EXE
                                                                                                                                                                                  ping -n 10 localhost
                                                                                                                                                                                  47⤵
                                                                                                                                                                                  • Runs ping.exe
                                                                                                                                                                                  PID:696
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Client-built.exe
                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
                                                                                                                                                                                  47⤵
                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                  • Suspicious use of SendNotifyMessage
                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                  PID:2784
                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\OLNnIus4TGzz.bat" "
                                                                                                                                                                                    48⤵
                                                                                                                                                                                      PID:816
                                                                                                                                                                                      • C:\Windows\system32\chcp.com
                                                                                                                                                                                        chcp 65001
                                                                                                                                                                                        49⤵
                                                                                                                                                                                          PID:868
                                                                                                                                                                                        • C:\Windows\system32\PING.EXE
                                                                                                                                                                                          ping -n 10 localhost
                                                                                                                                                                                          49⤵
                                                                                                                                                                                          • Runs ping.exe
                                                                                                                                                                                          PID:4408
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Client-built.exe
                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
                                                                                                                                                                                          49⤵
                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                          • Suspicious use of SendNotifyMessage
                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                          PID:1220
                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FF2FPOQHOLIF.bat" "
                                                                                                                                                                                            50⤵
                                                                                                                                                                                              PID:2160
                                                                                                                                                                                              • C:\Windows\system32\chcp.com
                                                                                                                                                                                                chcp 65001
                                                                                                                                                                                                51⤵
                                                                                                                                                                                                  PID:1464
                                                                                                                                                                                                • C:\Windows\system32\PING.EXE
                                                                                                                                                                                                  ping -n 10 localhost
                                                                                                                                                                                                  51⤵
                                                                                                                                                                                                  • Runs ping.exe
                                                                                                                                                                                                  PID:4216
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Client-built.exe
                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
                                                                                                                                                                                                  51⤵
                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                  • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                  PID:3048
                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FAXOJgk0PmGk.bat" "
                                                                                                                                                                                                    52⤵
                                                                                                                                                                                                      PID:428
                                                                                                                                                                                                      • C:\Windows\system32\chcp.com
                                                                                                                                                                                                        chcp 65001
                                                                                                                                                                                                        53⤵
                                                                                                                                                                                                          PID:212
                                                                                                                                                                                                        • C:\Windows\system32\PING.EXE
                                                                                                                                                                                                          ping -n 10 localhost
                                                                                                                                                                                                          53⤵
                                                                                                                                                                                                          • Runs ping.exe
                                                                                                                                                                                                          PID:4536
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Client-built.exe
                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
                                                                                                                                                                                                          53⤵
                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                          • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                          PID:216
                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\jeddqsGb8032.bat" "
                                                                                                                                                                                                            54⤵
                                                                                                                                                                                                              PID:2980
                                                                                                                                                                                                              • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                chcp 65001
                                                                                                                                                                                                                55⤵
                                                                                                                                                                                                                  PID:2512
                                                                                                                                                                                                                • C:\Windows\system32\PING.EXE
                                                                                                                                                                                                                  ping -n 10 localhost
                                                                                                                                                                                                                  55⤵
                                                                                                                                                                                                                  • Runs ping.exe
                                                                                                                                                                                                                  PID:2440
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Client-built.exe
                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
                                                                                                                                                                                                                  55⤵
                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                  • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                  PID:1520
                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\kVw8qXqBsxMW.bat" "
                                                                                                                                                                                                                    56⤵
                                                                                                                                                                                                                      PID:2500
                                                                                                                                                                                                                      • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                        chcp 65001
                                                                                                                                                                                                                        57⤵
                                                                                                                                                                                                                          PID:1104
                                                                                                                                                                                                                        • C:\Windows\system32\PING.EXE
                                                                                                                                                                                                                          ping -n 10 localhost
                                                                                                                                                                                                                          57⤵
                                                                                                                                                                                                                          • Runs ping.exe
                                                                                                                                                                                                                          PID:4952
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Client-built.exe
                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
                                                                                                                                                                                                                          57⤵
                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                          • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                          PID:4000
                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\8jUl0ZbVCc1P.bat" "
                                                                                                                                                                                                                            58⤵
                                                                                                                                                                                                                              PID:2812
                                                                                                                                                                                                                              • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                chcp 65001
                                                                                                                                                                                                                                59⤵
                                                                                                                                                                                                                                  PID:1052
                                                                                                                                                                                                                                • C:\Windows\system32\PING.EXE
                                                                                                                                                                                                                                  ping -n 10 localhost
                                                                                                                                                                                                                                  59⤵
                                                                                                                                                                                                                                  • Runs ping.exe
                                                                                                                                                                                                                                  PID:2796
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Client-built.exe
                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
                                                                                                                                                                                                                                  59⤵
                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                  • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                  PID:1940
                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\hAIqE2ZaTUGL.bat" "
                                                                                                                                                                                                                                    60⤵
                                                                                                                                                                                                                                      PID:2968
                                                                                                                                                                                                                                      • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                        chcp 65001
                                                                                                                                                                                                                                        61⤵
                                                                                                                                                                                                                                          PID:4116
                                                                                                                                                                                                                                        • C:\Windows\system32\PING.EXE
                                                                                                                                                                                                                                          ping -n 10 localhost
                                                                                                                                                                                                                                          61⤵
                                                                                                                                                                                                                                          • Runs ping.exe
                                                                                                                                                                                                                                          PID:4316
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Client-built.exe
                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
                                                                                                                                                                                                                                          61⤵
                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                          • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                          PID:4700
                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EJzQzlFggdqD.bat" "
                                                                                                                                                                                                                                            62⤵
                                                                                                                                                                                                                                              PID:480
                                                                                                                                                                                                                                              • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                chcp 65001
                                                                                                                                                                                                                                                63⤵
                                                                                                                                                                                                                                                  PID:468
                                                                                                                                                                                                                                                • C:\Windows\system32\PING.EXE
                                                                                                                                                                                                                                                  ping -n 10 localhost
                                                                                                                                                                                                                                                  63⤵
                                                                                                                                                                                                                                                  • Runs ping.exe
                                                                                                                                                                                                                                                  PID:4868
                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Client-built.exe
                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
                                                                                                                                                                                                                                                  63⤵
                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                  • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                  PID:2504
                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TESKv5w0I9ok.bat" "
                                                                                                                                                                                                                                                    64⤵
                                                                                                                                                                                                                                                      PID:4800
                                                                                                                                                                                                                                                      • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                        chcp 65001
                                                                                                                                                                                                                                                        65⤵
                                                                                                                                                                                                                                                          PID:872
                                                                                                                                                                                                                                                        • C:\Windows\system32\PING.EXE
                                                                                                                                                                                                                                                          ping -n 10 localhost
                                                                                                                                                                                                                                                          65⤵
                                                                                                                                                                                                                                                          • Runs ping.exe
                                                                                                                                                                                                                                                          PID:2400
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Client-built.exe
                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
                                                                                                                                                                                                                                                          65⤵
                                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                          • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                          PID:2332
                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\6MIAdoF8S4TJ.bat" "
                                                                                                                                                                                                                                                            66⤵
                                                                                                                                                                                                                                                              PID:1512
                                                                                                                                                                                                                                                              • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                chcp 65001
                                                                                                                                                                                                                                                                67⤵
                                                                                                                                                                                                                                                                  PID:4996
                                                                                                                                                                                                                                                                • C:\Windows\system32\PING.EXE
                                                                                                                                                                                                                                                                  ping -n 10 localhost
                                                                                                                                                                                                                                                                  67⤵
                                                                                                                                                                                                                                                                  • Runs ping.exe
                                                                                                                                                                                                                                                                  PID:1008
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Client-built.exe
                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
                                                                                                                                                                                                                                                                  67⤵
                                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                  • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                  PID:3652
                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ZWnMlAZOEJqj.bat" "
                                                                                                                                                                                                                                                                    68⤵
                                                                                                                                                                                                                                                                      PID:2036
                                                                                                                                                                                                                                                                      • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                        chcp 65001
                                                                                                                                                                                                                                                                        69⤵
                                                                                                                                                                                                                                                                          PID:2980
                                                                                                                                                                                                                                                                        • C:\Windows\system32\PING.EXE
                                                                                                                                                                                                                                                                          ping -n 10 localhost
                                                                                                                                                                                                                                                                          69⤵
                                                                                                                                                                                                                                                                          • Runs ping.exe
                                                                                                                                                                                                                                                                          PID:4644
                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Client-built.exe
                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
                                                                                                                                                                                                                                                                          69⤵
                                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                          • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                          PID:1656
                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Q9s8CoEIDI7q.bat" "
                                                                                                                                                                                                                                                                            70⤵
                                                                                                                                                                                                                                                                              PID:4152
                                                                                                                                                                                                                                                                              • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                chcp 65001
                                                                                                                                                                                                                                                                                71⤵
                                                                                                                                                                                                                                                                                  PID:2464
                                                                                                                                                                                                                                                                                • C:\Windows\system32\PING.EXE
                                                                                                                                                                                                                                                                                  ping -n 10 localhost
                                                                                                                                                                                                                                                                                  71⤵
                                                                                                                                                                                                                                                                                  • Runs ping.exe
                                                                                                                                                                                                                                                                                  PID:1640
                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Client-built.exe
                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
                                                                                                                                                                                                                                                                                  71⤵
                                                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                  • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                  PID:1052
                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\fM87sMugxjEl.bat" "
                                                                                                                                                                                                                                                                                    72⤵
                                                                                                                                                                                                                                                                                      PID:2372
                                                                                                                                                                                                                                                                                      • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                        chcp 65001
                                                                                                                                                                                                                                                                                        73⤵
                                                                                                                                                                                                                                                                                          PID:2812
                                                                                                                                                                                                                                                                                        • C:\Windows\system32\PING.EXE
                                                                                                                                                                                                                                                                                          ping -n 10 localhost
                                                                                                                                                                                                                                                                                          73⤵
                                                                                                                                                                                                                                                                                          • Runs ping.exe
                                                                                                                                                                                                                                                                                          PID:3568
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Client-built.exe
                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
                                                                                                                                                                                                                                                                                          73⤵
                                                                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                          • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                          PID:1720
                                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\QW5PASqhQLou.bat" "
                                                                                                                                                                                                                                                                                            74⤵
                                                                                                                                                                                                                                                                                              PID:3924
                                                                                                                                                                                                                                                                                              • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                chcp 65001
                                                                                                                                                                                                                                                                                                75⤵
                                                                                                                                                                                                                                                                                                  PID:4008
                                                                                                                                                                                                                                                                                                • C:\Windows\system32\PING.EXE
                                                                                                                                                                                                                                                                                                  ping -n 10 localhost
                                                                                                                                                                                                                                                                                                  75⤵
                                                                                                                                                                                                                                                                                                  • Runs ping.exe
                                                                                                                                                                                                                                                                                                  PID:3756
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Client-built.exe
                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
                                                                                                                                                                                                                                                                                                  75⤵
                                                                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                  • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                  PID:4212
                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\PMLpE77vKdUd.bat" "
                                                                                                                                                                                                                                                                                                    76⤵
                                                                                                                                                                                                                                                                                                      PID:472
                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                        chcp 65001
                                                                                                                                                                                                                                                                                                        77⤵
                                                                                                                                                                                                                                                                                                          PID:1152
                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\PING.EXE
                                                                                                                                                                                                                                                                                                          ping -n 10 localhost
                                                                                                                                                                                                                                                                                                          77⤵
                                                                                                                                                                                                                                                                                                          • Runs ping.exe
                                                                                                                                                                                                                                                                                                          PID:1120
                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Client-built.exe
                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
                                                                                                                                                                                                                                                                                                          77⤵
                                                                                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                          • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                          PID:480
                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CnqiTVZnxSBx.bat" "
                                                                                                                                                                                                                                                                                                            78⤵
                                                                                                                                                                                                                                                                                                              PID:4504
                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                chcp 65001
                                                                                                                                                                                                                                                                                                                79⤵
                                                                                                                                                                                                                                                                                                                  PID:4568
                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\PING.EXE
                                                                                                                                                                                                                                                                                                                  ping -n 10 localhost
                                                                                                                                                                                                                                                                                                                  79⤵
                                                                                                                                                                                                                                                                                                                  • Runs ping.exe
                                                                                                                                                                                                                                                                                                                  PID:3504
                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Client-built.exe
                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
                                                                                                                                                                                                                                                                                                                  79⤵
                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                                  • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                  PID:4992
                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\MQxCAinQJ8dJ.bat" "
                                                                                                                                                                                                                                                                                                                    80⤵
                                                                                                                                                                                                                                                                                                                      PID:1900
                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                        chcp 65001
                                                                                                                                                                                                                                                                                                                        81⤵
                                                                                                                                                                                                                                                                                                                          PID:4512
                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\PING.EXE
                                                                                                                                                                                                                                                                                                                          ping -n 10 localhost
                                                                                                                                                                                                                                                                                                                          81⤵
                                                                                                                                                                                                                                                                                                                          • Runs ping.exe
                                                                                                                                                                                                                                                                                                                          PID:2328
                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Client-built.exe
                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
                                                                                                                                                                                                                                                                                                                          81⤵
                                                                                                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                                          • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                          PID:4552
                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\MQwmOJCwbn1G.bat" "
                                                                                                                                                                                                                                                                                                                            82⤵
                                                                                                                                                                                                                                                                                                                              PID:4444
                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                chcp 65001
                                                                                                                                                                                                                                                                                                                                83⤵
                                                                                                                                                                                                                                                                                                                                  PID:4372
                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\PING.EXE
                                                                                                                                                                                                                                                                                                                                  ping -n 10 localhost
                                                                                                                                                                                                                                                                                                                                  83⤵
                                                                                                                                                                                                                                                                                                                                  • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                  PID:5024
                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Client-built.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
                                                                                                                                                                                                                                                                                                                                  83⤵
                                                                                                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                                                  • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                  PID:3920
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pxIFeoSu7A8P.bat" "
                                                                                                                                                                                                                                                                                                                                    84⤵
                                                                                                                                                                                                                                                                                                                                      PID:1704
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                        chcp 65001
                                                                                                                                                                                                                                                                                                                                        85⤵
                                                                                                                                                                                                                                                                                                                                          PID:4360
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\PING.EXE
                                                                                                                                                                                                                                                                                                                                          ping -n 10 localhost
                                                                                                                                                                                                                                                                                                                                          85⤵
                                                                                                                                                                                                                                                                                                                                            PID:3144
                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Client-built.exe
                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
                                                                                                                                                                                                                                                                                                                                            85⤵
                                                                                                                                                                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                            • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                                                            • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                            PID:680
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\P6dpQyK03SDZ.bat" "
                                                                                                                                                                                                                                                                                                                                              86⤵
                                                                                                                                                                                                                                                                                                                                                PID:3952
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                  chcp 65001
                                                                                                                                                                                                                                                                                                                                                  87⤵
                                                                                                                                                                                                                                                                                                                                                    PID:1296
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\PING.EXE
                                                                                                                                                                                                                                                                                                                                                    ping -n 10 localhost
                                                                                                                                                                                                                                                                                                                                                    87⤵
                                                                                                                                                                                                                                                                                                                                                    • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                    PID:4148
                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Client-built.exe
                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
                                                                                                                                                                                                                                                                                                                                                    87⤵
                                                                                                                                                                                                                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                    • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                                                                    • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                    PID:2812
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\kKNpQwhZHkR8.bat" "
                                                                                                                                                                                                                                                                                                                                                      88⤵
                                                                                                                                                                                                                                                                                                                                                        PID:3536
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                          chcp 65001
                                                                                                                                                                                                                                                                                                                                                          89⤵
                                                                                                                                                                                                                                                                                                                                                            PID:3160
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\PING.EXE
                                                                                                                                                                                                                                                                                                                                                            ping -n 10 localhost
                                                                                                                                                                                                                                                                                                                                                            89⤵
                                                                                                                                                                                                                                                                                                                                                            • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                            PID:1596
                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Client-built.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
                                                                                                                                                                                                                                                                                                                                                            89⤵
                                                                                                                                                                                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                            • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                                                                            • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                            PID:2368
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FJfLOdtgKpLi.bat" "
                                                                                                                                                                                                                                                                                                                                                              90⤵
                                                                                                                                                                                                                                                                                                                                                                PID:3116
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                  chcp 65001
                                                                                                                                                                                                                                                                                                                                                                  91⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:3304
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\PING.EXE
                                                                                                                                                                                                                                                                                                                                                                    ping -n 10 localhost
                                                                                                                                                                                                                                                                                                                                                                    91⤵
                                                                                                                                                                                                                                                                                                                                                                    • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                                    PID:3844
                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Client-built.exe
                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
                                                                                                                                                                                                                                                                                                                                                                    91⤵
                                                                                                                                                                                                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                    • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                                                                                    • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                                                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                    PID:624
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SPess8i3zC6h.bat" "
                                                                                                                                                                                                                                                                                                                                                                      92⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:4976
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                          chcp 65001
                                                                                                                                                                                                                                                                                                                                                                          93⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:3316
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\PING.EXE
                                                                                                                                                                                                                                                                                                                                                                            ping -n 10 localhost
                                                                                                                                                                                                                                                                                                                                                                            93⤵
                                                                                                                                                                                                                                                                                                                                                                            • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                                            PID:2204
                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Client-built.exe
                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
                                                                                                                                                                                                                                                                                                                                                                            93⤵
                                                                                                                                                                                                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                            • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                                                                                            • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                            PID:568
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\BgW2u4M0DYeN.bat" "
                                                                                                                                                                                                                                                                                                                                                                              94⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:4456
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                  chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                  95⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:4640
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\PING.EXE
                                                                                                                                                                                                                                                                                                                                                                                    ping -n 10 localhost
                                                                                                                                                                                                                                                                                                                                                                                    95⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:2324
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Client-built.exe
                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
                                                                                                                                                                                                                                                                                                                                                                                      95⤵
                                                                                                                                                                                                                                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                      • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                                                                                                      • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                                                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                      PID:5080
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\jwN1FyP8KciE.bat" "
                                                                                                                                                                                                                                                                                                                                                                                        96⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:1512
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                            chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                            97⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:1008
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\PING.EXE
                                                                                                                                                                                                                                                                                                                                                                                              ping -n 10 localhost
                                                                                                                                                                                                                                                                                                                                                                                              97⤵
                                                                                                                                                                                                                                                                                                                                                                                              • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                                                              PID:4636
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Client-built.exe
                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
                                                                                                                                                                                                                                                                                                                                                                                              97⤵
                                                                                                                                                                                                                                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                              • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                                                                                                              • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                                                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                              PID:3624
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\BZQBYy1mhOo8.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                98⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:5020
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                                    chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                                    99⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:1652
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\PING.EXE
                                                                                                                                                                                                                                                                                                                                                                                                      ping -n 10 localhost
                                                                                                                                                                                                                                                                                                                                                                                                      99⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                      PID:3344
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Client-built.exe
                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
                                                                                                                                                                                                                                                                                                                                                                                                      99⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                      • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                                                                                                                      • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                                                                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                                      PID:3184
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Y7Ya9NKJ1tMB.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                        100⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:4360
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                                            chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                                            101⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:4952
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\PING.EXE
                                                                                                                                                                                                                                                                                                                                                                                                              ping -n 10 localhost
                                                                                                                                                                                                                                                                                                                                                                                                              101⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                              PID:1104
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Client-built.exe
                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
                                                                                                                                                                                                                                                                                                                                                                                                              101⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                              • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                                                                                                                              • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                                                                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                                              PID:4064
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\0L3n3I8AQp7G.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                102⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5096
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                                                    chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                                                    103⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3568
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\PING.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                      ping -n 10 localhost
                                                                                                                                                                                                                                                                                                                                                                                                                      103⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2056
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Client-built.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                      103⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                      • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                                                                                                                                      • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                                                                                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1552
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\BJJHuEpZTsx7.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                        104⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2112
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                                                            chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                                                            105⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4548
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\PING.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                              ping -n 10 localhost
                                                                                                                                                                                                                                                                                                                                                                                                                              105⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3668
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Client-built.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                              105⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                              • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                                                                                                                                              • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                                                                                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1772
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Fse4RNjkJqok.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                                106⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:696
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                                                                    chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                                                                    107⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1608
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\PING.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                      ping -n 10 localhost
                                                                                                                                                                                                                                                                                                                                                                                                                                      107⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:876
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Client-built.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                      107⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:976
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\oulqhMkDlLRi.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                                        108⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3968
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                                                                            chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                                                                            109⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:704
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\PING.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                              ping -n 10 localhost
                                                                                                                                                                                                                                                                                                                                                                                                                                              109⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5068
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Client-built.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                              109⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                              • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                                                                                                                                                              • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                                                                                                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3800
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\QKAObM5KRPPx.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                110⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2764
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                    chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                                                                                    111⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1624
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\PING.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                      ping -n 10 localhost
                                                                                                                                                                                                                                                                                                                                                                                                                                                      111⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4908
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Client-built.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                      111⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2184
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TzlJRfXFqRD1.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                        112⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1652
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                            chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                                                                                            113⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5020
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\PING.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                              ping -n 10 localhost
                                                                                                                                                                                                                                                                                                                                                                                                                                                              113⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:184
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Client-built.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                              113⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4644
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\oGXAq2XqJxF3.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                                114⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1660
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    115⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4324
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\PING.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      ping -n 10 localhost
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      115⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:244
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Client-built.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      115⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3392
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\XXWvhKuHfsF6.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        116⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3568
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            117⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:940
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\PING.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              ping -n 10 localhost
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              117⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2968
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Client-built.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                117⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3160
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\NVj2UNXu3H2V.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  118⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2916
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      119⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1828
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\PING.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        ping -n 10 localhost
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        119⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3488
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Client-built.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        119⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2776
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\F8osXGPVdkfX.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          120⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3828
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              121⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3164
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\PING.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                ping -n 10 localhost
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                121⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2300
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Client-built.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                121⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1056
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7z8ZbyvVXERi.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  122⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1516
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      123⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3564
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\PING.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        ping -n 10 localhost
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        123⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:872
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Client-built.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        123⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3996
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\uJgfI0ewojNQ.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          124⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1584
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              125⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1352
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\PING.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                ping -n 10 localhost
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                125⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:648
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Client-built.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                125⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4536
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\okZJ40cbmF8f.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  126⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3916
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      127⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3860
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\PING.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        ping -n 10 localhost
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        127⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:960
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Client-built.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        127⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1248
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\XShz4IuoLBfK.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          128⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2528
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              129⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3660
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\PING.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                ping -n 10 localhost
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                129⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4416
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Client-built.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                129⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1704
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mhiM35yCbgNZ.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  130⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1800
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      131⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:228
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\PING.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        ping -n 10 localhost
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        131⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2876
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Client-built.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          131⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4264
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EiHlJLTt2nHG.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              132⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3568
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  133⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5088
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\PING.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    ping -n 10 localhost
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    133⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3128
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Client-built.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    133⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3312
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\jMoWz3AKvk6w.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      134⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1060
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          135⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4692
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\PING.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            ping -n 10 localhost
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            135⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:560
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Client-built.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            135⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:640
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\YNF05zjQAWGe.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                136⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2160
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    137⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2300
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\PING.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      ping -n 10 localhost
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      137⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2436
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Client-built.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      137⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3504
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ylmDWi1hnsz5.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        138⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4800
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            139⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3412
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\PING.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              ping -n 10 localhost
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              139⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2328
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Client-built.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              139⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1756
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\2uVMrfVH1f7J.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                140⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:648
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    141⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4916
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\PING.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      ping -n 10 localhost
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      141⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5092
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Client-built.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      141⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4048
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\BylYvTfIKRXR.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        142⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2252
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            143⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3580
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\PING.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              ping -n 10 localhost
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              143⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4956
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Client-built.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              143⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2180
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VGU9vEt5JnqM.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                144⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3992
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    145⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2500
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\PING.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      ping -n 10 localhost
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      145⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4604
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Client-built.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        145⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:664
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\849tDG6MXEsD.bat" "
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          146⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4128
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\chcp.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              chcp 65001
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              147⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2968
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\PING.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                ping -n 10 localhost
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                147⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5108
                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                                              C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                              • Drops desktop.ini file(s)
                                                                                                                                                                                                                                                                                                              • Checks processor information in registry
                                                                                                                                                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                                                                                                                                                              PID:4004
                                                                                                                                                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3208 --field-trial-handle=2256,i,6670388345726423024,18382795228658886258,262144 --variations-seed-version /prefetch:8
                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                PID:3616
                                                                                                                                                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3236 --field-trial-handle=2256,i,6670388345726423024,18382795228658886258,262144 --variations-seed-version /prefetch:8
                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                  PID:1588

                                                                                                                                                                                                                                                                                                                Network

                                                                                                                                                                                                                                                                                                                      MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                                                                                                                      Replay Monitor

                                                                                                                                                                                                                                                                                                                      Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                      Downloads

                                                                                                                                                                                                                                                                                                                      Client-built.exe.log
                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Client-built.exe.log
                                                                                                                                                                                                                                                                                                                      • Size 2KB
                                                                                                                                                                                                                                                                                                                      • SHA256 da740d78ae00b72cb3710d1a1256dc6431550965d20afaa65e5d5860a4748e8c
                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                      0L3n3I8AQp7G.bat
                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\0L3n3I8AQp7G.bat
                                                                                                                                                                                                                                                                                                                      • Size 209B
                                                                                                                                                                                                                                                                                                                      • SHA256 dcbdaf14b849740f2b06779b2645b693785af351fc9d9b726a65e90157aab9dd
                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                      1jFHetSnAER3.bat
                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\1jFHetSnAER3.bat
                                                                                                                                                                                                                                                                                                                      • Size 209B
                                                                                                                                                                                                                                                                                                                      • SHA256 876d3a5996cbfae642b2cae6c640512f6224852a17e9ef3921d2630ccfb2cbca
                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                      4oMu7VMdEqvC.bat
                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\4oMu7VMdEqvC.bat
                                                                                                                                                                                                                                                                                                                      • Size 209B
                                                                                                                                                                                                                                                                                                                      • SHA256 924c2321f28d826948bd5c4316f446fe92ab4337582d22addb6b7592a83bbc99
                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                      6MIAdoF8S4TJ.bat
                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\6MIAdoF8S4TJ.bat
                                                                                                                                                                                                                                                                                                                      • Size 209B
                                                                                                                                                                                                                                                                                                                      • SHA256 e5f01c941638f11599d573828aa9843a7cfc8e28b4b79cc6b6607c86dbb317d3
                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                      7z8ZbyvVXERi.bat
                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\7z8ZbyvVXERi.bat
                                                                                                                                                                                                                                                                                                                      • Size 209B
                                                                                                                                                                                                                                                                                                                      • SHA256 065a6b8b6d96c83a3696b51b2bb738942b1b0e7509f6e1fa924b9474aab33589
                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                      8jUl0ZbVCc1P.bat
                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\8jUl0ZbVCc1P.bat
                                                                                                                                                                                                                                                                                                                      • Size 209B
                                                                                                                                                                                                                                                                                                                      • SHA256 80d4a553b7c24d80db0732ef93bdd34be9485aa6a796a61d0144969e3721281c
                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                      AZo46z4yoQG5.bat
                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\AZo46z4yoQG5.bat
                                                                                                                                                                                                                                                                                                                      • Size 209B
                                                                                                                                                                                                                                                                                                                      • SHA256 5c7dd0946aa1febeaba58545cb25ab0bfd1eee92b82e7876b092df04981b0019
                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                      BJJHuEpZTsx7.bat
                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\BJJHuEpZTsx7.bat
                                                                                                                                                                                                                                                                                                                      • Size 209B
                                                                                                                                                                                                                                                                                                                      • SHA256 eadf53acfe73b954329c90e12a403b5d5135b5e6e3f72832b2a88cbaecfd2968
                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                      BZQBYy1mhOo8.bat
                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\BZQBYy1mhOo8.bat
                                                                                                                                                                                                                                                                                                                      • Size 209B
                                                                                                                                                                                                                                                                                                                      • SHA256 36f4974078c74945786ef5d89f2c3f2776afbc847f2f66a9c26d60039373a170
                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                      BgW2u4M0DYeN.bat
                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\BgW2u4M0DYeN.bat
                                                                                                                                                                                                                                                                                                                      • Size 209B
                                                                                                                                                                                                                                                                                                                      • SHA256 4658a444040cc29996a59d6e6a6025d995a38d32b52755875db06655ac7c1f95
                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                      CnqiTVZnxSBx.bat
                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\CnqiTVZnxSBx.bat
                                                                                                                                                                                                                                                                                                                      • Size 209B
                                                                                                                                                                                                                                                                                                                      • SHA256 829a46909b8a5f62b05d692bb07a36736c1ce60cdc32378584211b8ce69be8b4
                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                      DZEfWEKvN6cD.bat
                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\DZEfWEKvN6cD.bat
                                                                                                                                                                                                                                                                                                                      • Size 209B
                                                                                                                                                                                                                                                                                                                      • SHA256 5d2e5087e70e20f263f45711ef77d6ca2f4e846aec4cb7b9acba466a099737d8
                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                      EJzQzlFggdqD.bat
                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\EJzQzlFggdqD.bat
                                                                                                                                                                                                                                                                                                                      • Size 209B
                                                                                                                                                                                                                                                                                                                      • SHA256 765bbc850083dce6a1953c7bbdbaa9ea1a30eef97575274c38257154c2b45114
                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                      F8osXGPVdkfX.bat
                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\F8osXGPVdkfX.bat
                                                                                                                                                                                                                                                                                                                      • Size 209B
                                                                                                                                                                                                                                                                                                                      • SHA256 cfd33c9a3c1e5c588c100b667112066494da7c9c1919c0fd5cbaa6bffe6a0461
                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                      FAXOJgk0PmGk.bat
                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\FAXOJgk0PmGk.bat
                                                                                                                                                                                                                                                                                                                      • Size 209B
                                                                                                                                                                                                                                                                                                                      • SHA256 d5b5d09e3fc4403091df08f8bdeae4292ae59c1e7e031919b1c97fb63f13fc6b
                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                      FF2FPOQHOLIF.bat
                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\FF2FPOQHOLIF.bat
                                                                                                                                                                                                                                                                                                                      • Size 209B
                                                                                                                                                                                                                                                                                                                      • SHA256 417b10b0ed4c44df2c8f1dce68b96a9aac8f0f7d73aaf0a75b5fa4ab1b845cd7
                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                      FJfLOdtgKpLi.bat
                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\FJfLOdtgKpLi.bat
                                                                                                                                                                                                                                                                                                                      • Size 209B
                                                                                                                                                                                                                                                                                                                      • SHA256 c2a1d6dc36dfe6b20b42c99e6579e102f168ea87d9b3b5da10a7300a1a91550f
                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                      FiCVqewD5HKv.bat
                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\FiCVqewD5HKv.bat
                                                                                                                                                                                                                                                                                                                      • Size 209B
                                                                                                                                                                                                                                                                                                                      • SHA256 00a9a4ed0fb40a52e8c23fee5557a57bebac5fdd75b07761b8b0ea869eaa3db3
                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                      Fse4RNjkJqok.bat
                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\Fse4RNjkJqok.bat
                                                                                                                                                                                                                                                                                                                      • Size 209B
                                                                                                                                                                                                                                                                                                                      • SHA256 0343e1fd829612505af50f5b1871ac00c96b5bd2620d677636333e974128b76d
                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                      LIBUpMAy3Tzn.bat
                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\LIBUpMAy3Tzn.bat
                                                                                                                                                                                                                                                                                                                      • Size 209B
                                                                                                                                                                                                                                                                                                                      • SHA256 d35e70fd734152a5f11a861f937202e27971b36ee45c5b8c7bdb41bcbec71d78
                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                      MQwmOJCwbn1G.bat
                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\MQwmOJCwbn1G.bat
                                                                                                                                                                                                                                                                                                                      • Size 209B
                                                                                                                                                                                                                                                                                                                      • SHA256 53fbcfac7e581dab070c7c0a7bb330d31f86e6dbb4994f8d0800a42571d9a773
                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                      MQxCAinQJ8dJ.bat
                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\MQxCAinQJ8dJ.bat
                                                                                                                                                                                                                                                                                                                      • Size 209B
                                                                                                                                                                                                                                                                                                                      • SHA256 f67b897d529fe247266af7ad2badee3bb824e098aea37f6c16c8b6cb86c9d633
                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                      Mb0CxXKrdcwe.bat
                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\Mb0CxXKrdcwe.bat
                                                                                                                                                                                                                                                                                                                      • Size 209B
                                                                                                                                                                                                                                                                                                                      • SHA256 3b9fcd1ed122eef3a5f20461e246d8da7442a2b8b5347ba119822cf80668e7b0
                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                      N0YekqzEJnLI.bat
                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\N0YekqzEJnLI.bat
                                                                                                                                                                                                                                                                                                                      • Size 209B
                                                                                                                                                                                                                                                                                                                      • SHA256 a91503bf92c86875b1ec95e8cc9e8801320fea85f59bf095e8bc80cda40a47d7
                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                      NVj2UNXu3H2V.bat
                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\NVj2UNXu3H2V.bat
                                                                                                                                                                                                                                                                                                                      • Size 209B
                                                                                                                                                                                                                                                                                                                      • SHA256 d29d604c6864d4e61fe22968a89ce4d563e30cf0824c8cf7bba1146e4519bca4
                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                      OLNnIus4TGzz.bat
                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\OLNnIus4TGzz.bat
                                                                                                                                                                                                                                                                                                                      • Size 209B
                                                                                                                                                                                                                                                                                                                      • SHA256 c8e3a9bcc595102abc51f7625ddbe93cb908b76dcf4cda6520b43984691a4f95
                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                      P6dpQyK03SDZ.bat
                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\P6dpQyK03SDZ.bat
                                                                                                                                                                                                                                                                                                                      • Size 209B
                                                                                                                                                                                                                                                                                                                      • SHA256 7f050152e6222eb528d92cb3522e57666a9459ae95b71ebe01968c6f9541193b
                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                      PMLpE77vKdUd.bat
                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\PMLpE77vKdUd.bat
                                                                                                                                                                                                                                                                                                                      • Size 209B
                                                                                                                                                                                                                                                                                                                      • SHA256 3e439d3ac5e440d5e36067849595aa8db017901f697422a38ab745ec56701a50
                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                      Q9s8CoEIDI7q.bat
                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\Q9s8CoEIDI7q.bat
                                                                                                                                                                                                                                                                                                                      • Size 209B
                                                                                                                                                                                                                                                                                                                      • SHA256 7c3ccec02cfcec41391b1a63c460abd8cd967b384b0bf6bf1b3b58750e587139
                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                      QKAObM5KRPPx.bat
                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\QKAObM5KRPPx.bat
                                                                                                                                                                                                                                                                                                                      • Size 209B
                                                                                                                                                                                                                                                                                                                      • SHA256 2596d78da2ae06eec23d8772ec141f6dc420563cc69dce9fd010514f71a5189b
                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                      QW5PASqhQLou.bat
                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\QW5PASqhQLou.bat
                                                                                                                                                                                                                                                                                                                      • Size 209B
                                                                                                                                                                                                                                                                                                                      • SHA256 7539633ecc17dfbfa418f12e3606c54cc1f1879bcb5091b3968251725615270b
                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                      Rt5932FRUbXB.bat
                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\Rt5932FRUbXB.bat
                                                                                                                                                                                                                                                                                                                      • Size 209B
                                                                                                                                                                                                                                                                                                                      • SHA256 045bdb5775796b87b3c4f8946dccc36c2cd7139f4874f05f29f0aaa0cdc6f7d0
                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                      SBpWgsyA0lLC.bat
                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\SBpWgsyA0lLC.bat
                                                                                                                                                                                                                                                                                                                      • Size 209B
                                                                                                                                                                                                                                                                                                                      • SHA256 327070174418f2392f3b4898a7b043f5e957bcee5ed0dcd98355b856a1e8b0d8
                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                      SPess8i3zC6h.bat
                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\SPess8i3zC6h.bat
                                                                                                                                                                                                                                                                                                                      • Size 209B
                                                                                                                                                                                                                                                                                                                      • SHA256 9553e46dc2ff08506e05d619e9fc02b9d11958572f1f0a085c7d8d79d64a8d76
                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                      TESKv5w0I9ok.bat
                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\TESKv5w0I9ok.bat
                                                                                                                                                                                                                                                                                                                      • Size 209B
                                                                                                                                                                                                                                                                                                                      • SHA256 59b2ae3be9b09b1e3caa8e53e3c3c3f6b8ac70a37428a34310ecf4d6b0e57c54
                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                      TYDzRPnIvhKv.bat
                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\TYDzRPnIvhKv.bat
                                                                                                                                                                                                                                                                                                                      • Size 209B
                                                                                                                                                                                                                                                                                                                      • SHA256 4b71e3c599c7e3927d2595bdff1349d31561c48afae3ea1772e787f173e8c548
                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                      TzlJRfXFqRD1.bat
                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\TzlJRfXFqRD1.bat
                                                                                                                                                                                                                                                                                                                      • Size 209B
                                                                                                                                                                                                                                                                                                                      • SHA256 a83610fcf8cce96e479750e4f424f78452a27dc013fad1d1f48d212b5d5d8d26
                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                      VLYVxW0vv82C.bat
                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\VLYVxW0vv82C.bat
                                                                                                                                                                                                                                                                                                                      • Size 209B
                                                                                                                                                                                                                                                                                                                      • SHA256 b3dc2fd4b42a9bd841e635f631ba8acbce725f6db74e9821b8132f34b08733ec
                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                      WW2zOQi6QB96.bat
                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\WW2zOQi6QB96.bat
                                                                                                                                                                                                                                                                                                                      • Size 209B
                                                                                                                                                                                                                                                                                                                      • SHA256 b4538f8e4bd28dc61d3e8a8f6cddabf0ca208c61db6d1eee170f6c7c769d7d29
                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                      XXWvhKuHfsF6.bat
                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\XXWvhKuHfsF6.bat
                                                                                                                                                                                                                                                                                                                      • Size 209B
                                                                                                                                                                                                                                                                                                                      • SHA256 f8f8699fa02684bf1a4749ee0db805975d34608d5351500e1bd3273662ebc783
                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                      Y7Ya9NKJ1tMB.bat
                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\Y7Ya9NKJ1tMB.bat
                                                                                                                                                                                                                                                                                                                      • Size 209B
                                                                                                                                                                                                                                                                                                                      • SHA256 146fbd9ea10a9346039b4aca43fcfec0146bd5910c578eccd923b946e1815dda
                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                      ZWnMlAZOEJqj.bat
                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\ZWnMlAZOEJqj.bat
                                                                                                                                                                                                                                                                                                                      • Size 209B
                                                                                                                                                                                                                                                                                                                      • SHA256 94f9f8783acf2fe18e2d9e35a391b23ec499e50f9cd7d96f076ab3f8b4bdfbf1
                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                      aNYuw594az7E.bat
                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\aNYuw594az7E.bat
                                                                                                                                                                                                                                                                                                                      • Size 209B
                                                                                                                                                                                                                                                                                                                      • SHA256 4c21f4689a4846591993a976875c3c002047e46a86f15aa6c2c3cad037c7dd20
                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                      cu9cOxnxXGGc.bat
                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\cu9cOxnxXGGc.bat
                                                                                                                                                                                                                                                                                                                      • Size 209B
                                                                                                                                                                                                                                                                                                                      • SHA256 2715d0819b875bfc2e9da4fc54abd11cb0b84303b803d701f10fa480370d182a
                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                      fM87sMugxjEl.bat
                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\fM87sMugxjEl.bat
                                                                                                                                                                                                                                                                                                                      • Size 209B
                                                                                                                                                                                                                                                                                                                      • SHA256 1f5f9fbcc234d0d1a9ca9611f5c0b6519ab4bd076376b074ed60035fa1b3b1a0
                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                      h9QGwYgYdBak.bat
                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\h9QGwYgYdBak.bat
                                                                                                                                                                                                                                                                                                                      • Size 209B
                                                                                                                                                                                                                                                                                                                      • SHA256 7acac766d18d3aa137280b85a049231e52ad8e6fd5c7776b0c27d0a64bbffcc4
                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                      hAIqE2ZaTUGL.bat
                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\hAIqE2ZaTUGL.bat
                                                                                                                                                                                                                                                                                                                      • Size 209B
                                                                                                                                                                                                                                                                                                                      • SHA256 1467c1d2e6f3ab3abf454f6b2cb037c6e8f381bb85d82cf1582b3b6706109e37
                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                      jF4kZADTTnJ6.bat
                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\jF4kZADTTnJ6.bat
                                                                                                                                                                                                                                                                                                                      • Size 209B
                                                                                                                                                                                                                                                                                                                      • SHA256 5b7878b0ee4ff69f1ba89dc59c7c28d20b816232d7eea7b5a50371b3ad213f82
                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                      jeddqsGb8032.bat
                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\jeddqsGb8032.bat
                                                                                                                                                                                                                                                                                                                      • Size 209B
                                                                                                                                                                                                                                                                                                                      • SHA256 f8646cc85fb7e91e198a3f2b5afa78a8f66c443f80c5d3ecda8aace5a756c1a0
                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                      jwN1FyP8KciE.bat
                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\jwN1FyP8KciE.bat
                                                                                                                                                                                                                                                                                                                      • Size 209B
                                                                                                                                                                                                                                                                                                                      • SHA256 945fba14147ea29e9ec1a584d5643d327092867072d3edec0988ece1c462b217
                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                      kKNpQwhZHkR8.bat
                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\kKNpQwhZHkR8.bat
                                                                                                                                                                                                                                                                                                                      • Size 209B
                                                                                                                                                                                                                                                                                                                      • SHA256 a96e818282aa50574861cb019ea7ef929e5222c7a2a534872a6fadb3869dfef3
                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                      kVw8qXqBsxMW.bat
                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\kVw8qXqBsxMW.bat
                                                                                                                                                                                                                                                                                                                      • Size 209B
                                                                                                                                                                                                                                                                                                                      • SHA256 5562e2bcd4ef095d6d43f51d3d92439badfa3eab70500b69485d19e6d7b5a299
                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                      mCRtil6Xfmob.bat
                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\mCRtil6Xfmob.bat
                                                                                                                                                                                                                                                                                                                      • Size 209B
                                                                                                                                                                                                                                                                                                                      • SHA256 39839fee8b523c1ceb7fe0e210bee30ac12072492c619405c067e8117864aeab
                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                      mP8YYnbq4lby.bat
                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\mP8YYnbq4lby.bat
                                                                                                                                                                                                                                                                                                                      • Size 209B
                                                                                                                                                                                                                                                                                                                      • SHA256 b2341e75030907f315f4564a939977b5599450e2c1567231858ed3d70ba91982
                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                      oGXAq2XqJxF3.bat
                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\oGXAq2XqJxF3.bat
                                                                                                                                                                                                                                                                                                                      • Size 209B
                                                                                                                                                                                                                                                                                                                      • SHA256 414a4ad39809d2cc53def3f279295b68d1a6faa4ffc290090df40261df7909c0
                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                      okZJ40cbmF8f.bat
                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\okZJ40cbmF8f.bat
                                                                                                                                                                                                                                                                                                                      • Size 209B
                                                                                                                                                                                                                                                                                                                      • SHA256 75c93ea9c95d18d97d3c333fbc88495831543da1f9fb99330b74627101e3e3f3
                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                      oulqhMkDlLRi.bat
                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\oulqhMkDlLRi.bat
                                                                                                                                                                                                                                                                                                                      • Size 209B
                                                                                                                                                                                                                                                                                                                      • SHA256 7ecd03224e2bdd777a617cb2f49785d246f20d6aa4c941a651c52bf869f7eac4
                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                      pxIFeoSu7A8P.bat
                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\pxIFeoSu7A8P.bat
                                                                                                                                                                                                                                                                                                                      • Size 209B
                                                                                                                                                                                                                                                                                                                      • SHA256 616c9e0d2a27de91d793c746ac0d0981aec0aa524345a652919a5cb7ace93cd5
                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                      sJ9jFYFStRlT.bat
                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\sJ9jFYFStRlT.bat
                                                                                                                                                                                                                                                                                                                      • Size 209B
                                                                                                                                                                                                                                                                                                                      • SHA256 eaaa9f51375f1b1d1ca8a9862ece259f593962a1617cc69fff70badc601571dd
                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                      tbx557gRMZdF.bat
                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\tbx557gRMZdF.bat
                                                                                                                                                                                                                                                                                                                      • Size 209B
                                                                                                                                                                                                                                                                                                                      • SHA256 5d5e67f5beef0f613f0db553c9a545b3793790948e1c28a08287ab2e02b22fab
                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                      uJgfI0ewojNQ.bat
                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\uJgfI0ewojNQ.bat
                                                                                                                                                                                                                                                                                                                      • Size 209B
                                                                                                                                                                                                                                                                                                                      • SHA256 25339f970d0801c011d598c59ca8b340283ffc3441a2c23e34be073ce7932610
                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                      xOtDNvfNHVrx.bat
                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\xOtDNvfNHVrx.bat
                                                                                                                                                                                                                                                                                                                      • Size 209B
                                                                                                                                                                                                                                                                                                                      • SHA256 45c589f65157de28bc6e7c5cb55495dcb5043068e2e7d0dcea515cd4a30f47e5
                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                      yAWGeFUoyA95.bat
                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\yAWGeFUoyA95.bat
                                                                                                                                                                                                                                                                                                                      • Size 209B
                                                                                                                                                                                                                                                                                                                      • SHA256 1b9f92397c392564a224c6ee0cf12cf2f237ee1771c65e395e041d35d911d673
                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                      desktop.ini
                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\Videos\Captures\desktop.ini
                                                                                                                                                                                                                                                                                                                      • Size 190B
                                                                                                                                                                                                                                                                                                                      • SHA256 86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2
                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                      memory/216-185-0x00007FF97AAA0000-0x00007FF97B561000-memory.dmp
                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                      memory/216-180-0x00007FF97AAA0000-0x00007FF97B561000-memory.dmp
                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                      memory/724-87-0x00007FF97AA20000-0x00007FF97B4E1000-memory.dmp
                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                      memory/724-83-0x00007FF97AA20000-0x00007FF97B4E1000-memory.dmp
                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                      memory/1032-113-0x00007FF97AAA0000-0x00007FF97B561000-memory.dmp
                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                      memory/1032-117-0x00007FF97AAA0000-0x00007FF97B561000-memory.dmp
                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                      memory/1144-77-0x00007FF97AA20000-0x00007FF97B4E1000-memory.dmp
                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                      memory/1144-81-0x00007FF97AA20000-0x00007FF97B4E1000-memory.dmp
                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                      memory/1184-0-0x0000000000600000-0x0000000000924000-memory.dmp
                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                      memory/1184-4-0x000000001C270000-0x000000001C322000-memory.dmp
                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                      memory/1184-10-0x00007FF97B670000-0x00007FF97C131000-memory.dmp
                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                      memory/1184-2-0x0000000002AC0000-0x0000000002AD0000-memory.dmp
                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                      memory/1184-1-0x00007FF97B670000-0x00007FF97C131000-memory.dmp
                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                      memory/1184-3-0x000000001C160000-0x000000001C1B0000-memory.dmp
                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                      memory/1220-168-0x00007FF97AAA0000-0x00007FF97B561000-memory.dmp
                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                      memory/1220-172-0x00007FF97AAA0000-0x00007FF97B561000-memory.dmp
                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                      memory/1288-101-0x00007FF97AAA0000-0x00007FF97B561000-memory.dmp
                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                      memory/1288-105-0x00007FF97AAA0000-0x00007FF97B561000-memory.dmp
                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                      memory/1520-186-0x00007FF97AAA0000-0x00007FF97B561000-memory.dmp
                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                      memory/1520-190-0x00007FF97AAA0000-0x00007FF97B561000-memory.dmp
                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                      memory/1788-20-0x0000000003050000-0x0000000003060000-memory.dmp
                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                      memory/1788-26-0x00007FF97AF10000-0x00007FF97B9D1000-memory.dmp
                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                      memory/1788-19-0x00007FF97AF10000-0x00007FF97B9D1000-memory.dmp
                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                      memory/1788-21-0x000000001D3D0000-0x000000001D8F8000-memory.dmp
                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                      memory/1804-89-0x00007FF97AA20000-0x00007FF97B4E1000-memory.dmp
                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                      memory/1804-93-0x00007FF97AA20000-0x00007FF97B4E1000-memory.dmp
                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                      memory/2000-160-0x00007FF97AAA0000-0x00007FF97B561000-memory.dmp
                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                      memory/2000-156-0x00007FF97AAA0000-0x00007FF97B561000-memory.dmp
                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                      memory/2092-142-0x00007FF97AAA0000-0x00007FF97B561000-memory.dmp
                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                      memory/2092-138-0x00007FF97AAA0000-0x00007FF97B561000-memory.dmp
                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                      memory/2376-95-0x00007FF97AA20000-0x00007FF97B4E1000-memory.dmp
                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                      memory/2376-99-0x00007FF97AA20000-0x00007FF97B4E1000-memory.dmp
                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                      memory/2572-47-0x00007FF97A5D0000-0x00007FF97B091000-memory.dmp
                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                      memory/2572-52-0x00007FF97A5D0000-0x00007FF97B091000-memory.dmp
                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                      memory/2752-111-0x00007FF97AAA0000-0x00007FF97B561000-memory.dmp
                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                      memory/2752-107-0x00007FF97AAA0000-0x00007FF97B561000-memory.dmp
                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                      memory/2784-166-0x00007FF97AAA0000-0x00007FF97B561000-memory.dmp
                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                      memory/2784-162-0x00007FF97AAA0000-0x00007FF97B561000-memory.dmp
                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                      memory/3004-59-0x00007FF97A5D0000-0x00007FF97B091000-memory.dmp
                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                      memory/3004-64-0x00007FF97A5D0000-0x00007FF97B091000-memory.dmp
                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                      memory/3048-179-0x00007FF97AAA0000-0x00007FF97B561000-memory.dmp
                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                      memory/3048-174-0x00007FF97AAA0000-0x00007FF97B561000-memory.dmp
                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                      memory/3188-130-0x00007FF97AAA0000-0x00007FF97B561000-memory.dmp
                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                      memory/3188-126-0x00007FF97AAA0000-0x00007FF97B561000-memory.dmp
                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                      memory/3344-69-0x00007FF97A5D0000-0x00007FF97B091000-memory.dmp
                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                      memory/3344-65-0x00007FF97A5D0000-0x00007FF97B091000-memory.dmp
                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                      memory/3636-41-0x00007FF9798C0000-0x00007FF97A381000-memory.dmp
                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                      memory/3636-46-0x00007FF9798C0000-0x00007FF97A381000-memory.dmp
                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                      memory/4268-136-0x00007FF97AAA0000-0x00007FF97B561000-memory.dmp
                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                      memory/4268-132-0x00007FF97AAA0000-0x00007FF97B561000-memory.dmp
                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                      memory/4272-154-0x00007FF97AAA0000-0x00007FF97B561000-memory.dmp
                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                      memory/4272-150-0x00007FF97AAA0000-0x00007FF97B561000-memory.dmp
                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                      memory/4452-12-0x00007FF97B670000-0x00007FF97C131000-memory.dmp
                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                      memory/4452-13-0x000000001B1C0000-0x000000001B1D0000-memory.dmp
                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                      memory/4452-18-0x00007FF97B670000-0x00007FF97C131000-memory.dmp
                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                      memory/4464-71-0x00007FF97AA20000-0x00007FF97B4E1000-memory.dmp
                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                      memory/4464-76-0x00007FF97AA20000-0x00007FF97B4E1000-memory.dmp
                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                      memory/4576-125-0x00007FF97AAA0000-0x00007FF97B561000-memory.dmp
                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                      memory/4576-120-0x0000000002620000-0x0000000002630000-memory.dmp
                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                      memory/4576-119-0x00007FF97AAA0000-0x00007FF97B561000-memory.dmp
                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                      memory/5092-58-0x00007FF97A5D0000-0x00007FF97B091000-memory.dmp
                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                      memory/5092-53-0x00007FF97A5D0000-0x00007FF97B091000-memory.dmp
                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                      memory/5116-149-0x00007FF97AAA0000-0x00007FF97B561000-memory.dmp
                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                      memory/5116-144-0x00007FF97AAA0000-0x00007FF97B561000-memory.dmp
                                                                                                                                                                                                                                                                                                                      Download