57f0ab779f8af92b82db560c9bc52987361fdfd8ae404f7512b8fe324077b881

Analysis

max time kernel
149s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25/05/2024, 19:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

57f0ab779f8af92b82db560c9bc52987361fdfd8ae404f7512b8fe324077b881.exe
Size

861KB
MD5

19deef89c7253c71b9c3316839093554
SHA1

a22c8670359b67efa6b33a7f5757f242d7f80b7b
SHA256

57f0ab779f8af92b82db560c9bc52987361fdfd8ae404f7512b8fe324077b881
SHA512

c369e7c4daa6e8f9c1d873b0253fc92b5c4a685ff4b069bdc11ac9e6220343cf12a027ac65af74b0438acd9ff2e2e9b35ed2b85dd5e23d91971cf04be7caf098
SSDEEP

24576:fnM/m/j0++Ge93ZKVbIaGoVFC/bXfRNuGN6mTQP0mv:vMRGe6zGmFGrN3QPBv

Score

7^/10

upx

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2492	fastboot.exe
2524	fastboot.exe
2424	fastboot.exe
1408	fastboot.exe
2832	fastboot.exe
2840	fastboot.exe
1656	fastboot.exe
632	fastboot.exe
1668	fastboot.exe
1288	fastboot.exe
1172	fastboot.exe
1872	fastboot.exe
1824	fastboot.exe
2088	fastboot.exe
1536	fastboot.exe
640	fastboot.exe
1884	fastboot.exe
964	fastboot.exe
2228	fastboot.exe
2116	fastboot.exe
2384	fastboot.exe
2932	fastboot.exe
1580	fastboot.exe
2560	fastboot.exe
2596	fastboot.exe
2092	fastboot.exe
2416	fastboot.exe
3052	fastboot.exe
2744	fastboot.exe
2604	fastboot.exe
2636	fastboot.exe
1496	fastboot.exe
3004	fastboot.exe
2280	fastboot.exe
1076	fastboot.exe
2944	fastboot.exe
2644	fastboot.exe
2792	fastboot.exe
1564	fastboot.exe
1604	fastboot.exe
1436	fastboot.exe
1668	fastboot.exe
2836	fastboot.exe
2072	fastboot.exe
1016	fastboot.exe
628	fastboot.exe
2056	fastboot.exe
1796	fastboot.exe
1148	fastboot.exe
1788	fastboot.exe
2324	fastboot.exe
1808	fastboot.exe
108	fastboot.exe
2012	fastboot.exe
1928	fastboot.exe
1644	fastboot.exe
1996	fastboot.exe
2100	fastboot.exe
2552	fastboot.exe
2096	fastboot.exe
2684	fastboot.exe
2816	fastboot.exe
2660	fastboot.exe
2544	fastboot.exe

Loads dropped DLL 64 IoCs

pid	Process
2712	cmd.exe
2712	cmd.exe
2492	fastboot.exe
2492	fastboot.exe
2464	cmd.exe
2464	cmd.exe
2524	fastboot.exe
2524	fastboot.exe
2968	cmd.exe
2968	cmd.exe
2424	fastboot.exe
2424	fastboot.exe
2568	cmd.exe
2568	cmd.exe
1408	fastboot.exe
1408	fastboot.exe
1264	cmd.exe
1264	cmd.exe
2832	fastboot.exe
2832	fastboot.exe
2760	cmd.exe
2760	cmd.exe
2840	fastboot.exe
2840	fastboot.exe
2996	cmd.exe
2996	cmd.exe
1656	fastboot.exe
1656	fastboot.exe
1528	cmd.exe
1528	cmd.exe
632	fastboot.exe
632	fastboot.exe
2360	cmd.exe
2360	cmd.exe
1668	fastboot.exe
1668	fastboot.exe
2072	cmd.exe
2072	cmd.exe
1288	fastboot.exe
1288	fastboot.exe
2892	cmd.exe
2892	cmd.exe
1172	fastboot.exe
1172	fastboot.exe
592	cmd.exe
592	cmd.exe
1872	fastboot.exe
1872	fastboot.exe
2004	cmd.exe
2004	cmd.exe
1824	fastboot.exe
1824	fastboot.exe
296	cmd.exe
296	cmd.exe
2088	fastboot.exe
2088	fastboot.exe
2184	cmd.exe
2184	cmd.exe
1536	fastboot.exe
1536	fastboot.exe
2036	cmd.exe
2036	cmd.exe
640	fastboot.exe
640	fastboot.exe

UPX packed file 25 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2748-1-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2748-4-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2748-3-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2748-2-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2748-26-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2748-24-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2748-30-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2748-45-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2748-42-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2748-38-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2748-37-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2748-34-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2748-32-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2748-28-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2748-8-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2748-6-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2748-40-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2748-22-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2748-20-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2748-18-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2748-16-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2748-14-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2748-12-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2748-11-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2748-98-0x0000000010000000-0x000000001003E000-memory.dmp	upx

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2748	57f0ab779f8af92b82db560c9bc52987361fdfd8ae404f7512b8fe324077b881.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2748	57f0ab779f8af92b82db560c9bc52987361fdfd8ae404f7512b8fe324077b881.exe
2748	57f0ab779f8af92b82db560c9bc52987361fdfd8ae404f7512b8fe324077b881.exe
2748	57f0ab779f8af92b82db560c9bc52987361fdfd8ae404f7512b8fe324077b881.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2748 wrote to memory of 2712	2748	57f0ab779f8af92b82db560c9bc52987361fdfd8ae404f7512b8fe324077b881.exe	28
PID 2748 wrote to memory of 2712	2748	57f0ab779f8af92b82db560c9bc52987361fdfd8ae404f7512b8fe324077b881.exe	28
PID 2748 wrote to memory of 2712	2748	57f0ab779f8af92b82db560c9bc52987361fdfd8ae404f7512b8fe324077b881.exe	28
PID 2748 wrote to memory of 2712	2748	57f0ab779f8af92b82db560c9bc52987361fdfd8ae404f7512b8fe324077b881.exe	28
PID 2712 wrote to memory of 2492	2712	cmd.exe	30
PID 2712 wrote to memory of 2492	2712	cmd.exe	30
PID 2712 wrote to memory of 2492	2712	cmd.exe	30
PID 2712 wrote to memory of 2492	2712	cmd.exe	30
PID 2748 wrote to memory of 2464	2748	57f0ab779f8af92b82db560c9bc52987361fdfd8ae404f7512b8fe324077b881.exe	31
PID 2748 wrote to memory of 2464	2748	57f0ab779f8af92b82db560c9bc52987361fdfd8ae404f7512b8fe324077b881.exe	31
PID 2748 wrote to memory of 2464	2748	57f0ab779f8af92b82db560c9bc52987361fdfd8ae404f7512b8fe324077b881.exe	31
PID 2748 wrote to memory of 2464	2748	57f0ab779f8af92b82db560c9bc52987361fdfd8ae404f7512b8fe324077b881.exe	31
PID 2464 wrote to memory of 2524	2464	cmd.exe	33
PID 2464 wrote to memory of 2524	2464	cmd.exe	33
PID 2464 wrote to memory of 2524	2464	cmd.exe	33
PID 2464 wrote to memory of 2524	2464	cmd.exe	33
PID 2748 wrote to memory of 2968	2748	57f0ab779f8af92b82db560c9bc52987361fdfd8ae404f7512b8fe324077b881.exe	34
PID 2748 wrote to memory of 2968	2748	57f0ab779f8af92b82db560c9bc52987361fdfd8ae404f7512b8fe324077b881.exe	34
PID 2748 wrote to memory of 2968	2748	57f0ab779f8af92b82db560c9bc52987361fdfd8ae404f7512b8fe324077b881.exe	34
PID 2748 wrote to memory of 2968	2748	57f0ab779f8af92b82db560c9bc52987361fdfd8ae404f7512b8fe324077b881.exe	34
PID 2968 wrote to memory of 2424	2968	cmd.exe	36
PID 2968 wrote to memory of 2424	2968	cmd.exe	36
PID 2968 wrote to memory of 2424	2968	cmd.exe	36
PID 2968 wrote to memory of 2424	2968	cmd.exe	36
PID 2748 wrote to memory of 2568	2748	57f0ab779f8af92b82db560c9bc52987361fdfd8ae404f7512b8fe324077b881.exe	37
PID 2748 wrote to memory of 2568	2748	57f0ab779f8af92b82db560c9bc52987361fdfd8ae404f7512b8fe324077b881.exe	37
PID 2748 wrote to memory of 2568	2748	57f0ab779f8af92b82db560c9bc52987361fdfd8ae404f7512b8fe324077b881.exe	37
PID 2748 wrote to memory of 2568	2748	57f0ab779f8af92b82db560c9bc52987361fdfd8ae404f7512b8fe324077b881.exe	37
PID 2568 wrote to memory of 1408	2568	cmd.exe	39
PID 2568 wrote to memory of 1408	2568	cmd.exe	39
PID 2568 wrote to memory of 1408	2568	cmd.exe	39
PID 2568 wrote to memory of 1408	2568	cmd.exe	39
PID 2748 wrote to memory of 1264	2748	57f0ab779f8af92b82db560c9bc52987361fdfd8ae404f7512b8fe324077b881.exe	40
PID 2748 wrote to memory of 1264	2748	57f0ab779f8af92b82db560c9bc52987361fdfd8ae404f7512b8fe324077b881.exe	40
PID 2748 wrote to memory of 1264	2748	57f0ab779f8af92b82db560c9bc52987361fdfd8ae404f7512b8fe324077b881.exe	40
PID 2748 wrote to memory of 1264	2748	57f0ab779f8af92b82db560c9bc52987361fdfd8ae404f7512b8fe324077b881.exe	40
PID 1264 wrote to memory of 2832	1264	cmd.exe	42
PID 1264 wrote to memory of 2832	1264	cmd.exe	42
PID 1264 wrote to memory of 2832	1264	cmd.exe	42
PID 1264 wrote to memory of 2832	1264	cmd.exe	42
PID 2748 wrote to memory of 2760	2748	57f0ab779f8af92b82db560c9bc52987361fdfd8ae404f7512b8fe324077b881.exe	43
PID 2748 wrote to memory of 2760	2748	57f0ab779f8af92b82db560c9bc52987361fdfd8ae404f7512b8fe324077b881.exe	43
PID 2748 wrote to memory of 2760	2748	57f0ab779f8af92b82db560c9bc52987361fdfd8ae404f7512b8fe324077b881.exe	43
PID 2748 wrote to memory of 2760	2748	57f0ab779f8af92b82db560c9bc52987361fdfd8ae404f7512b8fe324077b881.exe	43
PID 2760 wrote to memory of 2840	2760	cmd.exe	45
PID 2760 wrote to memory of 2840	2760	cmd.exe	45
PID 2760 wrote to memory of 2840	2760	cmd.exe	45
PID 2760 wrote to memory of 2840	2760	cmd.exe	45
PID 2748 wrote to memory of 2996	2748	57f0ab779f8af92b82db560c9bc52987361fdfd8ae404f7512b8fe324077b881.exe	46
PID 2748 wrote to memory of 2996	2748	57f0ab779f8af92b82db560c9bc52987361fdfd8ae404f7512b8fe324077b881.exe	46
PID 2748 wrote to memory of 2996	2748	57f0ab779f8af92b82db560c9bc52987361fdfd8ae404f7512b8fe324077b881.exe	46
PID 2748 wrote to memory of 2996	2748	57f0ab779f8af92b82db560c9bc52987361fdfd8ae404f7512b8fe324077b881.exe	46
PID 2996 wrote to memory of 1656	2996	cmd.exe	48
PID 2996 wrote to memory of 1656	2996	cmd.exe	48
PID 2996 wrote to memory of 1656	2996	cmd.exe	48
PID 2996 wrote to memory of 1656	2996	cmd.exe	48
PID 2748 wrote to memory of 1528	2748	57f0ab779f8af92b82db560c9bc52987361fdfd8ae404f7512b8fe324077b881.exe	49
PID 2748 wrote to memory of 1528	2748	57f0ab779f8af92b82db560c9bc52987361fdfd8ae404f7512b8fe324077b881.exe	49
PID 2748 wrote to memory of 1528	2748	57f0ab779f8af92b82db560c9bc52987361fdfd8ae404f7512b8fe324077b881.exe	49
PID 2748 wrote to memory of 1528	2748	57f0ab779f8af92b82db560c9bc52987361fdfd8ae404f7512b8fe324077b881.exe	49
PID 1528 wrote to memory of 632	1528	cmd.exe	51
PID 1528 wrote to memory of 632	1528	cmd.exe	51
PID 1528 wrote to memory of 632	1528	cmd.exe	51
PID 1528 wrote to memory of 632	1528	cmd.exe	51

C:\Users\Admin\AppData\Local\Temp\57f0ab779f8af92b82db560c9bc52987361fdfd8ae404f7512b8fe324077b881.exe
"C:\Users\Admin\AppData\Local\Temp\57f0ab779f8af92b82db560c9bc52987361fdfd8ae404f7512b8fe324077b881.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2748
- C:\Windows\SysWOW64\cmd.exe
  /c fastboot devices
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2712
- - C:\Users\Admin\AppData\Local\Temp\fastboot.exe
    fastboot devices
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2492
- C:\Windows\SysWOW64\cmd.exe
  /c fastboot devices
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2464
- - C:\Users\Admin\AppData\Local\Temp\fastboot.exe
    fastboot devices
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2524
- C:\Windows\SysWOW64\cmd.exe
  /c fastboot devices
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2968
- - C:\Users\Admin\AppData\Local\Temp\fastboot.exe
    fastboot devices
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2424
- C:\Windows\SysWOW64\cmd.exe
  /c fastboot devices
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2568
- - C:\Users\Admin\AppData\Local\Temp\fastboot.exe
    fastboot devices
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1408
- C:\Windows\SysWOW64\cmd.exe
  /c fastboot devices
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1264
- - C:\Users\Admin\AppData\Local\Temp\fastboot.exe
    fastboot devices
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2832
- C:\Windows\SysWOW64\cmd.exe
  /c fastboot devices
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2760
- - C:\Users\Admin\AppData\Local\Temp\fastboot.exe
    fastboot devices
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2840
- C:\Windows\SysWOW64\cmd.exe
  /c fastboot devices
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2996
- - C:\Users\Admin\AppData\Local\Temp\fastboot.exe
    fastboot devices
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1656
- C:\Windows\SysWOW64\cmd.exe
  /c fastboot devices
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1528
- - C:\Users\Admin\AppData\Local\Temp\fastboot.exe
    fastboot devices
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:632
- C:\Windows\SysWOW64\cmd.exe
  /c fastboot devices
  2⤵
  - Loads dropped DLL
  PID:2360
- - C:\Users\Admin\AppData\Local\Temp\fastboot.exe
    fastboot devices
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1668
- C:\Windows\SysWOW64\cmd.exe
  /c fastboot devices
  2⤵
  - Loads dropped DLL
  PID:2072
- - C:\Users\Admin\AppData\Local\Temp\fastboot.exe
    fastboot devices
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1288
- C:\Windows\SysWOW64\cmd.exe
  /c fastboot devices
  2⤵
  - Loads dropped DLL
  PID:2892
- - C:\Users\Admin\AppData\Local\Temp\fastboot.exe
    fastboot devices
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1172
- C:\Windows\SysWOW64\cmd.exe
  /c fastboot devices
  2⤵
  - Loads dropped DLL
  PID:592
- - C:\Users\Admin\AppData\Local\Temp\fastboot.exe
    fastboot devices
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1872
- C:\Windows\SysWOW64\cmd.exe
  /c fastboot devices
  2⤵
  - Loads dropped DLL
  PID:2004
- - C:\Users\Admin\AppData\Local\Temp\fastboot.exe
    fastboot devices
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1824
- C:\Windows\SysWOW64\cmd.exe
  /c fastboot devices
  2⤵
  - Loads dropped DLL
  PID:296
- - C:\Users\Admin\AppData\Local\Temp\fastboot.exe
    fastboot devices
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2088
- C:\Windows\SysWOW64\cmd.exe
  /c fastboot devices
  2⤵
  - Loads dropped DLL
  PID:2184
- - C:\Users\Admin\AppData\Local\Temp\fastboot.exe
    fastboot devices
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1536
- C:\Windows\SysWOW64\cmd.exe
  /c fastboot devices
  2⤵
  - Loads dropped DLL
  PID:2036
- - C:\Users\Admin\AppData\Local\Temp\fastboot.exe
    fastboot devices
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:640
- C:\Windows\SysWOW64\cmd.exe
  /c fastboot devices
  2⤵
  PID:1036
- - C:\Users\Admin\AppData\Local\Temp\fastboot.exe
    fastboot devices
    3⤵
    - Executes dropped EXE
    PID:1884
- C:\Windows\SysWOW64\cmd.exe
  /c fastboot devices
  2⤵
  PID:1856
- - C:\Users\Admin\AppData\Local\Temp\fastboot.exe
    fastboot devices
    3⤵
    - Executes dropped EXE
    PID:964
- C:\Windows\SysWOW64\cmd.exe
  /c fastboot devices
  2⤵
  PID:580
- - C:\Users\Admin\AppData\Local\Temp\fastboot.exe
    fastboot devices
    3⤵
    - Executes dropped EXE
    PID:2228
- C:\Windows\SysWOW64\cmd.exe
  /c fastboot devices
  2⤵
  PID:768
- - C:\Users\Admin\AppData\Local\Temp\fastboot.exe
    fastboot devices
    3⤵
    - Executes dropped EXE
    PID:2116
- C:\Windows\SysWOW64\cmd.exe
  /c fastboot devices
  2⤵
  PID:2240
- - C:\Users\Admin\AppData\Local\Temp\fastboot.exe
    fastboot devices
    3⤵
    - Executes dropped EXE
    PID:2384
- C:\Windows\SysWOW64\cmd.exe
  /c fastboot devices
  2⤵
  PID:2400
- - C:\Users\Admin\AppData\Local\Temp\fastboot.exe
    fastboot devices
    3⤵
    - Executes dropped EXE
    PID:2932
- C:\Windows\SysWOW64\cmd.exe
  /c fastboot devices
  2⤵
  PID:1672
- - C:\Users\Admin\AppData\Local\Temp\fastboot.exe
    fastboot devices
    3⤵
    - Executes dropped EXE
    PID:1580
- C:\Windows\SysWOW64\cmd.exe
  /c fastboot devices
  2⤵
  PID:2912
- - C:\Users\Admin\AppData\Local\Temp\fastboot.exe
    fastboot devices
    3⤵
    - Executes dropped EXE
    PID:2560
- C:\Windows\SysWOW64\cmd.exe
  /c fastboot devices
  2⤵
  PID:2872
- - C:\Users\Admin\AppData\Local\Temp\fastboot.exe
    fastboot devices
    3⤵
    - Executes dropped EXE
    PID:2596
- C:\Windows\SysWOW64\cmd.exe
  /c fastboot devices
  2⤵
  PID:2672
- - C:\Users\Admin\AppData\Local\Temp\fastboot.exe
    fastboot devices
    3⤵
    - Executes dropped EXE
    PID:2092
- C:\Windows\SysWOW64\cmd.exe
  /c fastboot devices
  2⤵
  PID:2112
- - C:\Users\Admin\AppData\Local\Temp\fastboot.exe
    fastboot devices
    3⤵
    - Executes dropped EXE
    PID:2416
- C:\Windows\SysWOW64\cmd.exe
  /c fastboot devices
  2⤵
  PID:2684
- - C:\Users\Admin\AppData\Local\Temp\fastboot.exe
    fastboot devices
    3⤵
    - Executes dropped EXE
    PID:3052
- C:\Windows\SysWOW64\cmd.exe
  /c fastboot devices
  2⤵
  PID:2504
- - C:\Users\Admin\AppData\Local\Temp\fastboot.exe
    fastboot devices
    3⤵
    - Executes dropped EXE
    PID:2744
- C:\Windows\SysWOW64\cmd.exe
  /c fastboot devices
  2⤵
  PID:2712
- - C:\Users\Admin\AppData\Local\Temp\fastboot.exe
    fastboot devices
    3⤵
    - Executes dropped EXE
    PID:2604
- C:\Windows\SysWOW64\cmd.exe
  /c fastboot devices
  2⤵
  PID:2640
- - C:\Users\Admin\AppData\Local\Temp\fastboot.exe
    fastboot devices
    3⤵
    - Executes dropped EXE
    PID:2636
- C:\Windows\SysWOW64\cmd.exe
  /c fastboot devices
  2⤵
  PID:2464
- - C:\Users\Admin\AppData\Local\Temp\fastboot.exe
    fastboot devices
    3⤵
    - Executes dropped EXE
    PID:1496
- C:\Windows\SysWOW64\cmd.exe
  /c fastboot devices
  2⤵
  PID:3048
- - C:\Users\Admin\AppData\Local\Temp\fastboot.exe
    fastboot devices
    3⤵
    - Executes dropped EXE
    PID:3004
- C:\Windows\SysWOW64\cmd.exe
  /c fastboot devices
  2⤵
  PID:2364
- - C:\Users\Admin\AppData\Local\Temp\fastboot.exe
    fastboot devices
    3⤵
    - Executes dropped EXE
    PID:2280
- C:\Windows\SysWOW64\cmd.exe
  /c fastboot devices
  2⤵
  PID:1164
- - C:\Users\Admin\AppData\Local\Temp\fastboot.exe
    fastboot devices
    3⤵
    - Executes dropped EXE
    PID:1076
- C:\Windows\SysWOW64\cmd.exe
  /c fastboot devices
  2⤵
  PID:1804
- - C:\Users\Admin\AppData\Local\Temp\fastboot.exe
    fastboot devices
    3⤵
    - Executes dropped EXE
    PID:2944
- C:\Windows\SysWOW64\cmd.exe
  /c fastboot devices
  2⤵
  PID:1444
- - C:\Users\Admin\AppData\Local\Temp\fastboot.exe
    fastboot devices
    3⤵
    - Executes dropped EXE
    PID:2644
- C:\Windows\SysWOW64\cmd.exe
  /c fastboot devices
  2⤵
  PID:2948
- - C:\Users\Admin\AppData\Local\Temp\fastboot.exe
    fastboot devices
    3⤵
    - Executes dropped EXE
    PID:2792
- C:\Windows\SysWOW64\cmd.exe
  /c fastboot devices
  2⤵
  PID:2756
- - C:\Users\Admin\AppData\Local\Temp\fastboot.exe
    fastboot devices
    3⤵
    - Executes dropped EXE
    PID:1564
- C:\Windows\SysWOW64\cmd.exe
  /c fastboot devices
  2⤵
  PID:2188
- - C:\Users\Admin\AppData\Local\Temp\fastboot.exe
    fastboot devices
    3⤵
    - Executes dropped EXE
    PID:1604
- C:\Windows\SysWOW64\cmd.exe
  /c fastboot devices
  2⤵
  PID:1772
- - C:\Users\Admin\AppData\Local\Temp\fastboot.exe
    fastboot devices
    3⤵
    - Executes dropped EXE
    PID:1436
- C:\Windows\SysWOW64\cmd.exe
  /c fastboot devices
  2⤵
  PID:1328
- - C:\Users\Admin\AppData\Local\Temp\fastboot.exe
    fastboot devices
    3⤵
    - Executes dropped EXE
    PID:1668
- C:\Windows\SysWOW64\cmd.exe
  /c fastboot devices
  2⤵
  PID:2360
- - C:\Users\Admin\AppData\Local\Temp\fastboot.exe
    fastboot devices
    3⤵
    - Executes dropped EXE
    PID:2836
- C:\Windows\SysWOW64\cmd.exe
  /c fastboot devices
  2⤵
  PID:2256
- - C:\Users\Admin\AppData\Local\Temp\fastboot.exe
    fastboot devices
    3⤵
    - Executes dropped EXE
    PID:2072
- C:\Windows\SysWOW64\cmd.exe
  /c fastboot devices
  2⤵
  PID:488
- - C:\Users\Admin\AppData\Local\Temp\fastboot.exe
    fastboot devices
    3⤵
    - Executes dropped EXE
    PID:1016
- C:\Windows\SysWOW64\cmd.exe
  /c fastboot devices
  2⤵
  PID:1156
- - C:\Users\Admin\AppData\Local\Temp\fastboot.exe
    fastboot devices
    3⤵
    - Executes dropped EXE
    PID:628
- C:\Windows\SysWOW64\cmd.exe
  /c fastboot devices
  2⤵
  PID:1872
- - C:\Users\Admin\AppData\Local\Temp\fastboot.exe
    fastboot devices
    3⤵
    - Executes dropped EXE
    PID:2056
- C:\Windows\SysWOW64\cmd.exe
  /c fastboot devices
  2⤵
  PID:2172
- - C:\Users\Admin\AppData\Local\Temp\fastboot.exe
    fastboot devices
    3⤵
    - Executes dropped EXE
    PID:1796
- C:\Windows\SysWOW64\cmd.exe
  /c fastboot devices
  2⤵
  PID:1880
- - C:\Users\Admin\AppData\Local\Temp\fastboot.exe
    fastboot devices
    3⤵
    - Executes dropped EXE
    PID:1148
- C:\Windows\SysWOW64\cmd.exe
  /c fastboot devices
  2⤵
  PID:1600
- - C:\Users\Admin\AppData\Local\Temp\fastboot.exe
    fastboot devices
    3⤵
    - Executes dropped EXE
    PID:1788
- C:\Windows\SysWOW64\cmd.exe
  /c fastboot devices
  2⤵
  PID:2320
- - C:\Users\Admin\AppData\Local\Temp\fastboot.exe
    fastboot devices
    3⤵
    - Executes dropped EXE
    PID:2324
- C:\Windows\SysWOW64\cmd.exe
  /c fastboot devices
  2⤵
  PID:912
- - C:\Users\Admin\AppData\Local\Temp\fastboot.exe
    fastboot devices
    3⤵
    - Executes dropped EXE
    PID:1808
- C:\Windows\SysWOW64\cmd.exe
  /c fastboot devices
  2⤵
  PID:696
- - C:\Users\Admin\AppData\Local\Temp\fastboot.exe
    fastboot devices
    3⤵
    - Executes dropped EXE
    PID:108
- C:\Windows\SysWOW64\cmd.exe
  /c fastboot devices
  2⤵
  PID:2032
- - C:\Users\Admin\AppData\Local\Temp\fastboot.exe
    fastboot devices
    3⤵
    - Executes dropped EXE
    PID:2012
- C:\Windows\SysWOW64\cmd.exe
  /c fastboot devices
  2⤵
  PID:300
- - C:\Users\Admin\AppData\Local\Temp\fastboot.exe
    fastboot devices
    3⤵
    - Executes dropped EXE
    PID:1928
- C:\Windows\SysWOW64\cmd.exe
  /c fastboot devices
  2⤵
  PID:1736
- - C:\Users\Admin\AppData\Local\Temp\fastboot.exe
    fastboot devices
    3⤵
    - Executes dropped EXE
    PID:1644
- C:\Windows\SysWOW64\cmd.exe
  /c fastboot devices
  2⤵
  PID:2000
- - C:\Users\Admin\AppData\Local\Temp\fastboot.exe
    fastboot devices
    3⤵
    - Executes dropped EXE
    PID:1996
- C:\Windows\SysWOW64\cmd.exe
  /c fastboot devices
  2⤵
  PID:3040
- - C:\Users\Admin\AppData\Local\Temp\fastboot.exe
    fastboot devices
    3⤵
    - Executes dropped EXE
    PID:2100
- C:\Windows\SysWOW64\cmd.exe
  /c fastboot devices
  2⤵
  PID:2304
- - C:\Users\Admin\AppData\Local\Temp\fastboot.exe
    fastboot devices
    3⤵
    - Executes dropped EXE
    PID:2552
- C:\Windows\SysWOW64\cmd.exe
  /c fastboot devices
  2⤵
  PID:2608
- - C:\Users\Admin\AppData\Local\Temp\fastboot.exe
    fastboot devices
    3⤵
    - Executes dropped EXE
    PID:2096
- C:\Windows\SysWOW64\cmd.exe
  /c fastboot devices
  2⤵
  PID:2592
- - C:\Users\Admin\AppData\Local\Temp\fastboot.exe
    fastboot devices
    3⤵
    - Executes dropped EXE
    PID:2684
- C:\Windows\SysWOW64\cmd.exe
  /c fastboot devices
  2⤵
  PID:2492
- - C:\Users\Admin\AppData\Local\Temp\fastboot.exe
    fastboot devices
    3⤵
    - Executes dropped EXE
    PID:2816
- C:\Windows\SysWOW64\cmd.exe
  /c fastboot devices
  2⤵
  PID:2732
- - C:\Users\Admin\AppData\Local\Temp\fastboot.exe
    fastboot devices
    3⤵
    - Executes dropped EXE
    PID:2660
- C:\Windows\SysWOW64\cmd.exe
  /c fastboot devices
  2⤵
  PID:2540
- - C:\Users\Admin\AppData\Local\Temp\fastboot.exe
    fastboot devices
    3⤵
    - Executes dropped EXE
    PID:2544
- C:\Windows\SysWOW64\cmd.exe
  /c fastboot devices
  2⤵
  PID:1816
- - C:\Users\Admin\AppData\Local\Temp\fastboot.exe
    fastboot devices
    3⤵
    PID:2800
- C:\Windows\SysWOW64\cmd.exe
  /c fastboot devices
  2⤵
  PID:2484
- - C:\Users\Admin\AppData\Local\Temp\fastboot.exe
    fastboot devices
    3⤵
    PID:3000
- C:\Windows\SysWOW64\cmd.exe
  /c fastboot devices
  2⤵
  PID:2964
- - C:\Users\Admin\AppData\Local\Temp\fastboot.exe
    fastboot devices
    3⤵
    PID:1300
- C:\Windows\SysWOW64\cmd.exe
  /c fastboot devices
  2⤵
  PID:1048
- - C:\Users\Admin\AppData\Local\Temp\fastboot.exe
    fastboot devices
    3⤵
    PID:1448
- C:\Windows\SysWOW64\cmd.exe
  /c fastboot devices
  2⤵
  PID:2844
- - C:\Users\Admin\AppData\Local\Temp\fastboot.exe
    fastboot devices
    3⤵
    PID:2024
- C:\Windows\SysWOW64\cmd.exe
  /c fastboot devices
  2⤵
  PID:2708
- - C:\Users\Admin\AppData\Local\Temp\fastboot.exe
    fastboot devices
    3⤵
    PID:1732
- C:\Windows\SysWOW64\cmd.exe
  /c fastboot devices
  2⤵
  PID:2808
- - C:\Users\Admin\AppData\Local\Temp\fastboot.exe
    fastboot devices
    3⤵
    PID:2776
- C:\Windows\SysWOW64\cmd.exe
  /c fastboot devices
  2⤵
  PID:2848
- - C:\Users\Admin\AppData\Local\Temp\fastboot.exe
    fastboot devices
    3⤵
    PID:1080
- C:\Windows\SysWOW64\cmd.exe
  /c fastboot devices
  2⤵
  PID:2940
- - C:\Users\Admin\AppData\Local\Temp\fastboot.exe
    fastboot devices
    3⤵
    PID:1664
- C:\Windows\SysWOW64\cmd.exe
  /c fastboot devices
  2⤵
  PID:1568
- - C:\Users\Admin\AppData\Local\Temp\fastboot.exe
    fastboot devices
    3⤵
    PID:1612
- C:\Windows\SysWOW64\cmd.exe
  /c fastboot devices
  2⤵
  PID:2084
- - C:\Users\Admin\AppData\Local\Temp\fastboot.exe
    fastboot devices
    3⤵
    PID:2276
- C:\Windows\SysWOW64\cmd.exe
  /c fastboot devices
  2⤵
  PID:1440
- - C:\Users\Admin\AppData\Local\Temp\fastboot.exe
    fastboot devices
    3⤵
    PID:2332
- C:\Windows\SysWOW64\cmd.exe
  /c fastboot devices
  2⤵
  PID:1976
- - C:\Users\Admin\AppData\Local\Temp\fastboot.exe
    fastboot devices
    3⤵
    PID:1288
- C:\Windows\SysWOW64\cmd.exe
  /c fastboot devices
  2⤵
  PID:792
- - C:\Users\Admin\AppData\Local\Temp\fastboot.exe
    fastboot devices
    3⤵
    PID:1172
- C:\Windows\SysWOW64\cmd.exe
  /c fastboot devices
  2⤵
  PID:760
- - C:\Users\Admin\AppData\Local\Temp\fastboot.exe
    fastboot devices
    3⤵
    PID:1724
- C:\Windows\SysWOW64\cmd.exe
  /c fastboot devices
  2⤵
  PID:2888
- - C:\Users\Admin\AppData\Local\Temp\fastboot.exe
    fastboot devices
    3⤵
    PID:592
- C:\Windows\SysWOW64\cmd.exe
  /c fastboot devices
  2⤵
  PID:1640
- - C:\Users\Admin\AppData\Local\Temp\fastboot.exe
    fastboot devices
    3⤵
    PID:240
- C:\Windows\SysWOW64\cmd.exe
  /c fastboot devices
  2⤵
  PID:960
- - C:\Users\Admin\AppData\Local\Temp\fastboot.exe
    fastboot devices
    3⤵
    PID:2152
- C:\Windows\SysWOW64\cmd.exe
  /c fastboot devices
  2⤵
  PID:1144
- - C:\Users\Admin\AppData\Local\Temp\fastboot.exe
    fastboot devices
    3⤵
    PID:1788
- C:\Windows\SysWOW64\cmd.exe
  /c fastboot devices
  2⤵
  PID:1368
- - C:\Users\Admin\AppData\Local\Temp\fastboot.exe
    fastboot devices
    3⤵
    PID:964
- C:\Windows\SysWOW64\cmd.exe
  /c fastboot devices
  2⤵
  PID:2320
- - C:\Users\Admin\AppData\Local\Temp\fastboot.exe
    fastboot devices
    3⤵
    PID:1808
- C:\Windows\SysWOW64\cmd.exe
  /c fastboot devices
  2⤵
  PID:2220
- - C:\Users\Admin\AppData\Local\Temp\fastboot.exe
    fastboot devices
    3⤵
    PID:580
- C:\Windows\SysWOW64\cmd.exe
  /c fastboot devices
  2⤵
  PID:2012
- - C:\Users\Admin\AppData\Local\Temp\fastboot.exe
    fastboot devices
    3⤵
    PID:2384
- C:\Windows\SysWOW64\cmd.exe
  /c fastboot devices
  2⤵
  PID:1928
- - C:\Users\Admin\AppData\Local\Temp\fastboot.exe
    fastboot devices
    3⤵
    PID:1492
- C:\Windows\SysWOW64\cmd.exe
  /c fastboot devices
  2⤵
  PID:904
- - C:\Users\Admin\AppData\Local\Temp\fastboot.exe
    fastboot devices
    3⤵
    PID:940
- C:\Windows\SysWOW64\cmd.exe
  /c fastboot devices
  2⤵
  PID:1984
- - C:\Users\Admin\AppData\Local\Temp\fastboot.exe
    fastboot devices
    3⤵
    PID:2308
- C:\Windows\SysWOW64\cmd.exe
  /c fastboot devices
  2⤵
  PID:2156
- - C:\Users\Admin\AppData\Local\Temp\fastboot.exe
    fastboot devices
    3⤵
    PID:1616
- C:\Windows\SysWOW64\cmd.exe
  /c fastboot devices
  2⤵
  PID:1828
- - C:\Users\Admin\AppData\Local\Temp\fastboot.exe
    fastboot devices
    3⤵
    PID:1372
- C:\Windows\SysWOW64\cmd.exe
  /c fastboot devices
  2⤵
  PID:2416
- - C:\Users\Admin\AppData\Local\Temp\fastboot.exe
    fastboot devices
    3⤵
    PID:2076
- C:\Windows\SysWOW64\cmd.exe
  /c fastboot devices
  2⤵
  PID:2664
- - C:\Users\Admin\AppData\Local\Temp\fastboot.exe
    fastboot devices
    3⤵
    PID:2676
- C:\Windows\SysWOW64\cmd.exe
  /c fastboot devices
  2⤵
  PID:2592
- - C:\Users\Admin\AppData\Local\Temp\fastboot.exe
    fastboot devices
    3⤵
    PID:2728
- C:\Windows\SysWOW64\cmd.exe
  /c fastboot devices
  2⤵
  PID:2744
- - C:\Users\Admin\AppData\Local\Temp\fastboot.exe
    fastboot devices
    3⤵
    PID:2580
- C:\Windows\SysWOW64\cmd.exe
  /c fastboot devices
  2⤵
  PID:2604
- - C:\Users\Admin\AppData\Local\Temp\fastboot.exe
    fastboot devices
    3⤵
    PID:2480
- C:\Windows\SysWOW64\cmd.exe
  /c fastboot devices
  2⤵
  PID:2488
- - C:\Users\Admin\AppData\Local\Temp\fastboot.exe
    fastboot devices
    3⤵
    PID:2528
- C:\Windows\SysWOW64\cmd.exe
  /c fastboot devices
  2⤵
  PID:2180
- - C:\Users\Admin\AppData\Local\Temp\fastboot.exe
    fastboot devices
    3⤵
    PID:1636
- C:\Windows\SysWOW64\cmd.exe
  /c fastboot devices
  2⤵
  PID:1032
- - C:\Users\Admin\AppData\Local\Temp\fastboot.exe
    fastboot devices
    3⤵
    PID:2160
- C:\Windows\SysWOW64\cmd.exe
  /c fastboot devices
  2⤵
  PID:1768
- - C:\Users\Admin\AppData\Local\Temp\fastboot.exe
    fastboot devices
    3⤵
    PID:2364
- C:\Windows\SysWOW64\cmd.exe
  /c fastboot devices
  2⤵
  PID:2196
- - C:\Users\Admin\AppData\Local\Temp\fastboot.exe
    fastboot devices
    3⤵
    PID:1076
- C:\Windows\SysWOW64\cmd.exe
  /c fastboot devices
  2⤵
  PID:1160
- - C:\Users\Admin\AppData\Local\Temp\fastboot.exe
    fastboot devices
    3⤵
    PID:2652
- C:\Windows\SysWOW64\cmd.exe
  /c fastboot devices
  2⤵
  PID:2024
- - C:\Users\Admin\AppData\Local\Temp\fastboot.exe
    fastboot devices
    3⤵
    PID:2824
- C:\Windows\SysWOW64\cmd.exe
  /c fastboot devices
  2⤵
  PID:1068
- - C:\Users\Admin\AppData\Local\Temp\fastboot.exe
    fastboot devices
    3⤵
    PID:2772
- C:\Windows\SysWOW64\cmd.exe
  /c fastboot devices
  2⤵
  PID:2536
- - C:\Users\Admin\AppData\Local\Temp\fastboot.exe
    fastboot devices
    3⤵
    PID:2980
- C:\Windows\SysWOW64\cmd.exe
  /c fastboot devices
  2⤵
  PID:2956
- - C:\Users\Admin\AppData\Local\Temp\fastboot.exe
    fastboot devices
    3⤵
    PID:1080
- C:\Windows\SysWOW64\cmd.exe
  /c fastboot devices
  2⤵
  PID:2268
- - C:\Users\Admin\AppData\Local\Temp\fastboot.exe
    fastboot devices
    3⤵
    PID:2996
- C:\Windows\SysWOW64\cmd.exe
  /c fastboot devices
  2⤵
  PID:2940
- - C:\Users\Admin\AppData\Local\Temp\fastboot.exe
    fastboot devices
    3⤵
    PID:1612
- C:\Windows\SysWOW64\cmd.exe
  /c fastboot devices
  2⤵
  PID:1628
- - C:\Users\Admin\AppData\Local\Temp\fastboot.exe
    fastboot devices
    3⤵
    PID:1228
- C:\Windows\SysWOW64\cmd.exe
  /c fastboot devices
  2⤵
  PID:2060
- - C:\Users\Admin\AppData\Local\Temp\fastboot.exe
    fastboot devices
    3⤵
    PID:2332
- C:\Windows\SysWOW64\cmd.exe
  /c fastboot devices
  2⤵
  PID:1440
- - C:\Users\Admin\AppData\Local\Temp\fastboot.exe
    fastboot devices
    3⤵
    PID:2408
- C:\Windows\SysWOW64\cmd.exe
  /c fastboot devices
  2⤵
  PID:2260
- - C:\Users\Admin\AppData\Local\Temp\fastboot.exe
    fastboot devices
    3⤵
    PID:1172
- C:\Windows\SysWOW64\cmd.exe
  /c fastboot devices
  2⤵
  PID:336
- - C:\Users\Admin\AppData\Local\Temp\fastboot.exe
    fastboot devices
    3⤵
    PID:688
- C:\Windows\SysWOW64\cmd.exe
  /c fastboot devices
  2⤵
  PID:488
- - C:\Users\Admin\AppData\Local\Temp\fastboot.exe
    fastboot devices
    3⤵
    PID:1868
- C:\Windows\SysWOW64\cmd.exe
  /c fastboot devices
  2⤵
  PID:1512
- - C:\Users\Admin\AppData\Local\Temp\fastboot.exe
    fastboot devices
    3⤵
    PID:2004
- C:\Windows\SysWOW64\cmd.exe
  /c fastboot devices
  2⤵
  PID:2088
- - C:\Users\Admin\AppData\Local\Temp\fastboot.exe
    fastboot devices
    3⤵
    PID:1360
- C:\Windows\SysWOW64\cmd.exe
  /c fastboot devices
  2⤵
  PID:1788
- - C:\Users\Admin\AppData\Local\Temp\fastboot.exe
    fastboot devices
    3⤵
    PID:984
- C:\Windows\SysWOW64\cmd.exe
  /c fastboot devices
  2⤵
  PID:2036
- - C:\Users\Admin\AppData\Local\Temp\fastboot.exe
    fastboot devices
    3⤵
    PID:1600
- C:\Windows\SysWOW64\cmd.exe
  /c fastboot devices
  2⤵
  PID:1904
- - C:\Users\Admin\AppData\Local\Temp\fastboot.exe
    fastboot devices
    3⤵
    PID:1596
- C:\Windows\SysWOW64\cmd.exe
  /c fastboot devices
  2⤵
  PID:884
- - C:\Users\Admin\AppData\Local\Temp\fastboot.exe
    fastboot devices
    3⤵
    PID:2208
- C:\Windows\SysWOW64\cmd.exe
  /c fastboot devices
  2⤵
  PID:1252
- - C:\Users\Admin\AppData\Local\Temp\fastboot.exe
    fastboot devices
    3⤵
    PID:2384
- C:\Windows\SysWOW64\cmd.exe
  /c fastboot devices
  2⤵
  PID:2136
- - C:\Users\Admin\AppData\Local\Temp\fastboot.exe
    fastboot devices
    3⤵
    PID:1584
- C:\Windows\SysWOW64\cmd.exe
  /c fastboot devices
  2⤵
  PID:608
- - C:\Users\Admin\AppData\Local\Temp\fastboot.exe
    fastboot devices
    3⤵
    PID:1196
- C:\Windows\SysWOW64\cmd.exe
  /c fastboot devices
  2⤵
  PID:1744
- - C:\Users\Admin\AppData\Local\Temp\fastboot.exe
    fastboot devices
    3⤵
    PID:2680
- C:\Windows\SysWOW64\cmd.exe
  /c fastboot devices
  2⤵
  PID:2308
- - C:\Users\Admin\AppData\Local\Temp\fastboot.exe
    fastboot devices
    3⤵
    PID:3064
- C:\Windows\SysWOW64\cmd.exe
  /c fastboot devices
  2⤵
  PID:3040
- - C:\Users\Admin\AppData\Local\Temp\fastboot.exe
    fastboot devices
    3⤵
    PID:2572
- C:\Windows\SysWOW64\cmd.exe
  /c fastboot devices
  2⤵
  PID:2020
- - C:\Users\Admin\AppData\Local\Temp\fastboot.exe
    fastboot devices
    3⤵
    PID:2692
- C:\Windows\SysWOW64\cmd.exe
  /c fastboot devices
  2⤵
  PID:2076
- - C:\Users\Admin\AppData\Local\Temp\fastboot.exe
    fastboot devices
    3⤵
    PID:2112
- C:\Windows\SysWOW64\cmd.exe
  /c fastboot devices
  2⤵
  PID:2696
- - C:\Users\Admin\AppData\Local\Temp\fastboot.exe
    fastboot devices
    3⤵
    PID:2672
- C:\Windows\SysWOW64\cmd.exe
  /c fastboot devices
  2⤵
  PID:2728
- - C:\Users\Admin\AppData\Local\Temp\fastboot.exe
    fastboot devices
    3⤵
    PID:2592
- C:\Windows\SysWOW64\cmd.exe
  /c fastboot devices
  2⤵
  PID:2492
- - C:\Users\Admin\AppData\Local\Temp\fastboot.exe
    fastboot devices
    3⤵
    PID:2628
- C:\Windows\SysWOW64\cmd.exe
  /c fastboot devices
  2⤵
  PID:2736
- - C:\Users\Admin\AppData\Local\Temp\fastboot.exe
    fastboot devices
    3⤵
    PID:2740
- C:\Windows\SysWOW64\cmd.exe
  /c fastboot devices
  2⤵
  PID:2800
- - C:\Users\Admin\AppData\Local\Temp\fastboot.exe
    fastboot devices
    3⤵
    PID:2636
- C:\Windows\SysWOW64\cmd.exe
  /c fastboot devices
  2⤵
  PID:2516
- - C:\Users\Admin\AppData\Local\Temp\fastboot.exe
    fastboot devices
    3⤵
    PID:2804
- C:\Windows\SysWOW64\cmd.exe
  /c fastboot devices
  2⤵
  PID:1332
- - C:\Users\Admin\AppData\Local\Temp\fastboot.exe
    fastboot devices
    3⤵
    PID:2160
- C:\Windows\SysWOW64\cmd.exe
  /c fastboot devices
  2⤵
  PID:3004
- - C:\Users\Admin\AppData\Local\Temp\fastboot.exe
    fastboot devices
    3⤵
    PID:2900
- C:\Windows\SysWOW64\cmd.exe
  /c fastboot devices
  2⤵
  PID:2828
- - C:\Users\Admin\AppData\Local\Temp\fastboot.exe
    fastboot devices
    3⤵
    PID:2568
- C:\Windows\SysWOW64\cmd.exe
  /c fastboot devices
  2⤵
  PID:2196
- - C:\Users\Admin\AppData\Local\Temp\fastboot.exe
    fastboot devices
    3⤵
    PID:1900
- C:\Windows\SysWOW64\cmd.exe
  /c fastboot devices
  2⤵
  PID:1160
- - C:\Users\Admin\AppData\Local\Temp\fastboot.exe
    fastboot devices
    3⤵
    PID:2824
- C:\Windows\SysWOW64\cmd.exe
  /c fastboot devices
  2⤵
  PID:2844
- - C:\Users\Admin\AppData\Local\Temp\fastboot.exe
    fastboot devices
    3⤵
    PID:2772
- C:\Windows\SysWOW64\cmd.exe
  /c fastboot devices
  2⤵
  PID:1732
- - C:\Users\Admin\AppData\Local\Temp\fastboot.exe
    fastboot devices
    3⤵
    PID:2948
- C:\Windows\SysWOW64\cmd.exe
  /c fastboot devices
  2⤵
  PID:2924
- - C:\Users\Admin\AppData\Local\Temp\fastboot.exe
    fastboot devices
    3⤵
    PID:2992
- C:\Windows\SysWOW64\cmd.exe
  /c fastboot devices
  2⤵
  PID:1564
- - C:\Users\Admin\AppData\Local\Temp\fastboot.exe
    fastboot devices
    3⤵
    PID:2996
- C:\Windows\SysWOW64\cmd.exe
  /c fastboot devices
  2⤵
  PID:1656
- - C:\Users\Admin\AppData\Local\Temp\fastboot.exe
    fastboot devices
    3⤵
    PID:1772
- C:\Windows\SysWOW64\cmd.exe
  /c fastboot devices
  2⤵
  PID:2124
- - C:\Users\Admin\AppData\Local\Temp\fastboot.exe
    fastboot devices
    3⤵
    PID:1228
- C:\Windows\SysWOW64\cmd.exe
  /c fastboot devices
  2⤵
  PID:1628
- - C:\Users\Admin\AppData\Local\Temp\fastboot.exe
    fastboot devices
    3⤵
    PID:1268

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\AdbWinApi.dll

Filesize
94KB

MD5
47a6ee3f186b2c2f5057028906bac0c6

SHA1
fde9c22a2cfcd5e566cec2e987d942b78a4eeae8

SHA256
14a51482aa003db79a400f4b15c158397fe6d57ee6606b3d633fa431a7bfdf4b

SHA512
6a2675de0c445c75f7d5664ebe8f0e2f69c3312c50156161e483927e40235140d5e28e340112ac552d6462366143890a8ce32dbf65bd37e27cb1ea290fe14584

Download Submit
\Users\Admin\AppData\Local\Temp\AdbWinUsbApi.dll

Filesize
59KB

MD5
5f23f2f936bdfac90bb0a4970ad365cf

SHA1
12e14244b1a5d04a261759547c3d930547f52fa3

SHA256
041c6859bb4fc78d3a903dd901298cd1ecfb75b6be0646b74954cd722280a407

SHA512
49a7769d5e6cb2fda9249039d90465f7a4e612805bba48b7036456a3bbd230e4d13da72e4ade5155ddc08fe460735ec8d6df3bb11b72ff28e1149221e2fc3048

Download Submit
\Users\Admin\AppData\Local\Temp\fastboot.exe

Filesize
153KB

MD5
a3c12797c0d0035effc2404fc1f405dc

SHA1
bf57b1115155fd739510702124e41a88cf45071c

SHA256
eccde6dd0636fee30fe7389042ee40e1c458b7eced52c90d062bd39875881c07

SHA512
a5c45dfd798a11fc55e2bda0cf459bd98e0218df2f7592b9eb4fce53c418efdbedd03c314ec91edd36d109801ed84301696cf8ca1999abfce72a83f8edf98ae6

Download Submit
memory/296-160-0x00000000002E0000-0x000000000030A000-memory.dmp

Filesize
168KB

Download
memory/296-159-0x00000000002E0000-0x000000000030A000-memory.dmp

Filesize
168KB

Download
memory/488-225-0x0000000000110000-0x000000000013A000-memory.dmp

Filesize
168KB

Download
memory/592-150-0x00000000001B0000-0x00000000001DA000-memory.dmp

Filesize
168KB

Download
memory/628-228-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/632-123-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/632-121-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/640-164-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/964-166-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1076-201-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1148-237-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1156-227-0x0000000000160000-0x000000000018A000-memory.dmp

Filesize
168KB

Download
memory/1172-147-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1264-288-0x0000000000330000-0x000000000035A000-memory.dmp

Filesize
168KB

Download
memory/1300-278-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1328-218-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1328-217-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1408-89-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1408-87-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1436-216-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1448-280-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1496-194-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1528-120-0x0000000000270000-0x000000000029A000-memory.dmp

Filesize
168KB

Download
memory/1536-162-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1564-211-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1580-177-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1600-239-0x0000000000120000-0x000000000014A000-memory.dmp

Filesize
168KB

Download
memory/1604-213-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1656-115-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1668-131-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1732-285-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1736-251-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1788-240-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1796-235-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1804-202-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1808-245-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1824-158-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1872-230-0x0000000000170000-0x000000000019A000-memory.dmp

Filesize
168KB

Download
memory/1872-155-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1872-152-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1928-250-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2024-283-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2032-247-0x0000000000380000-0x00000000003AA000-memory.dmp

Filesize
168KB

Download
memory/2056-232-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2072-135-0x0000000000180000-0x00000000001AA000-memory.dmp

Filesize
168KB

Download
memory/2072-136-0x0000000000180000-0x00000000001AA000-memory.dmp

Filesize
168KB

Download
memory/2088-161-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2096-262-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2096-264-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2100-257-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2116-170-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2172-233-0x0000000000160000-0x000000000018A000-memory.dmp

Filesize
168KB

Download
memory/2228-168-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2256-222-0x0000000000120000-0x000000000014A000-memory.dmp

Filesize
168KB

Download
memory/2256-223-0x0000000000120000-0x000000000014A000-memory.dmp

Filesize
168KB

Download
memory/2324-243-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2360-127-0x00000000001E0000-0x000000000020A000-memory.dmp

Filesize
168KB

Download
memory/2364-198-0x0000000000120000-0x000000000014A000-memory.dmp

Filesize
168KB

Download
memory/2384-173-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2424-81-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2424-79-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2464-70-0x0000000000260000-0x000000000028A000-memory.dmp

Filesize
168KB

Download
memory/2492-65-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2492-60-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2524-71-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2524-73-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2544-271-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2552-259-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2560-179-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2568-85-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2596-181-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2604-190-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2608-261-0x0000000000260000-0x000000000028A000-memory.dmp

Filesize
168KB

Download
memory/2636-192-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2640-191-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2644-206-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2660-270-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2684-266-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2712-58-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2712-59-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2744-187-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2748-12-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2748-24-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2748-1-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2748-4-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2748-3-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2748-2-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2748-26-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2748-30-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2748-11-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2748-133-0x0000000000400000-0x0000000000669000-memory.dmp

Filesize
2.4MB

Download
memory/2748-96-0x0000000000400000-0x0000000000669000-memory.dmp

Filesize
2.4MB

Download
memory/2748-0-0x0000000000400000-0x0000000000669000-memory.dmp

Filesize
2.4MB

Download
memory/2748-45-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2748-14-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2748-16-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2748-18-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2748-20-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2748-22-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2748-40-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2748-6-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2748-8-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2748-28-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2748-32-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2748-98-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2748-34-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2748-37-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2748-38-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2748-42-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2760-105-0x0000000000270000-0x000000000029A000-memory.dmp

Filesize
168KB

Download
memory/2760-104-0x0000000000270000-0x000000000029A000-memory.dmp

Filesize
168KB

Download
memory/2776-287-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2792-209-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2800-274-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2816-268-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2832-97-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2836-221-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2840-106-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2932-175-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2944-204-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2948-207-0x0000000000370000-0x000000000039A000-memory.dmp

Filesize
168KB

Download
memory/2968-78-0x00000000001F0000-0x000000000021A000-memory.dmp

Filesize
168KB

Download
memory/2996-111-0x00000000001E0000-0x000000000020A000-memory.dmp

Filesize
168KB

Download
memory/3000-275-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3004-197-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3040-254-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3040-255-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3052-184-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download