f277c264e31b5a55b2fb33e6bd32964b455b7d47da22907fc04e13d2c5d1d0e0

Analysis

max time kernel
50s
max time network
44s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
27/01/2024, 22:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

7b65f3b2f451ca36d1f2ae8f797b7ca5.exe
Size

17KB
MD5

7b65f3b2f451ca36d1f2ae8f797b7ca5
SHA1

76e5a8a0ec9059aa4bfb3217b3cb2683ad3cd364
SHA256

f277c264e31b5a55b2fb33e6bd32964b455b7d47da22907fc04e13d2c5d1d0e0
SHA512

546a00abadc7f7f88705552ff3e0d3ae27c54f366fb5521d7a502ac5e363ca233701f48e81ede8f9eadbbb224a5a105801f40e357389e23b768983c2ceb9ee0d
SSDEEP

192:ITgIiRyRmYwekxp9H4E6o4xOQ1ZxwkgzIUgHS7/vbmjsDLobVyUvV6GYHj9YdmN7:I1Et1956L310tJDvigvopXcN3L

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 9 IoCs

pid	Process
5612	mkjraler.exe
7592	mkjraler.exe
10396	mkjraler.exe
8132	mkjraler.exe
11040	mkjraler.exe
3792	mkjraler.exe
4348	mkjraler.exe
8936	mkjraler.exe
7532	mkjraler.exe

Drops file in System32 directory 49 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\mkjraler.exe	mkjraler.exe
File created	C:\Windows\SysWOW64\arjrkler.dll	mkjraler.exe
File opened for modification	C:\Windows\SysWOW64\mkjraler.exe	mkjraler.exe
File created	C:\Windows\SysWOW64\arjrkler.dll	mkjraler.exe
File created	C:\Windows\SysWOW64\arjrkler.dll	mkjraler.exe
File opened for modification	C:\Windows\SysWOW64\verclsid.exe	mkjraler.exe
File opened for modification	C:\Windows\SysWOW64\mkjraler.exe	7b65f3b2f451ca36d1f2ae8f797b7ca5.exe
File opened for modification	C:\Windows\SysWOW64\verclsid.exe	mkjraler.exe
File created	C:\Windows\SysWOW64\arjrkler.dll	mkjraler.exe
File opened for modification	C:\Windows\SysWOW64\iujraler.sys	mkjraler.exe
File opened for modification	C:\Windows\SysWOW64\verclsid.exe	mkjraler.exe
File opened for modification	C:\Windows\SysWOW64\arjrkler.dll	mkjraler.exe
File opened for modification	C:\Windows\SysWOW64\arjrkler.dll	mkjraler.exe
File opened for modification	C:\Windows\SysWOW64\iujraler.sys	mkjraler.exe
File opened for modification	C:\Windows\SysWOW64\verclsid.exe	mkjraler.exe
File opened for modification	C:\Windows\SysWOW64\arjrkler.dll	mkjraler.exe
File opened for modification	C:\Windows\SysWOW64\iujraler.sys	mkjraler.exe
File created	C:\Windows\SysWOW64\arjrkler.dll	mkjraler.exe
File opened for modification	C:\Windows\SysWOW64\mkjraler.exe	mkjraler.exe
File opened for modification	C:\Windows\SysWOW64\mkjraler.exe	mkjraler.exe
File opened for modification	C:\Windows\SysWOW64\iujraler.sys	mkjraler.exe
File opened for modification	C:\Windows\SysWOW64\iujraler.sys	7b65f3b2f451ca36d1f2ae8f797b7ca5.exe
File created	C:\Windows\SysWOW64\arjrkler.dll	mkjraler.exe
File opened for modification	C:\Windows\SysWOW64\arjrkler.dll	mkjraler.exe
File opened for modification	C:\Windows\SysWOW64\iujraler.sys	mkjraler.exe
File created	C:\Windows\SysWOW64\arjrkler.dll	mkjraler.exe
File opened for modification	C:\Windows\SysWOW64\mkjraler.exe	mkjraler.exe
File opened for modification	C:\Windows\SysWOW64\verclsid.exe	mkjraler.exe
File opened for modification	C:\Windows\SysWOW64\verclsid.exe	mkjraler.exe
File opened for modification	C:\Windows\SysWOW64\verclsid.exe	mkjraler.exe
File created	C:\Windows\SysWOW64\arjrkler.dll	7b65f3b2f451ca36d1f2ae8f797b7ca5.exe
File created	C:\Windows\SysWOW64\mkjraler.exe	7b65f3b2f451ca36d1f2ae8f797b7ca5.exe
File created	C:\Windows\SysWOW64\arjrkler.dll	mkjraler.exe
File opened for modification	C:\Windows\SysWOW64\arjrkler.dll	7b65f3b2f451ca36d1f2ae8f797b7ca5.exe
File created	C:\Windows\SysWOW64\arjrkler.dll	mkjraler.exe
File opened for modification	C:\Windows\SysWOW64\arjrkler.dll	mkjraler.exe
File opened for modification	C:\Windows\SysWOW64\iujraler.sys	mkjraler.exe
File opened for modification	C:\Windows\SysWOW64\arjrkler.dll	mkjraler.exe
File opened for modification	C:\Windows\SysWOW64\verclsid.exe	mkjraler.exe
File opened for modification	C:\Windows\SysWOW64\arjrkler.dll	mkjraler.exe
File opened for modification	C:\Windows\SysWOW64\iujraler.sys	mkjraler.exe
File opened for modification	C:\Windows\SysWOW64\mkjraler.exe	mkjraler.exe
File opened for modification	C:\Windows\SysWOW64\mkjraler.exe	mkjraler.exe
File opened for modification	C:\Windows\SysWOW64\arjrkler.dll	mkjraler.exe
File opened for modification	C:\Windows\SysWOW64\mkjraler.exe	mkjraler.exe
File opened for modification	C:\Windows\SysWOW64\verclsid.exe	7b65f3b2f451ca36d1f2ae8f797b7ca5.exe
File opened for modification	C:\Windows\SysWOW64\iujraler.sys	mkjraler.exe
File opened for modification	C:\Windows\SysWOW64\arjrkler.dll	mkjraler.exe
File opened for modification	C:\Windows\SysWOW64\verclsid.exe	mkjraler.exe

Modifies registry class 30 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	7b65f3b2f451ca36d1f2ae8f797b7ca5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DC69134A-F15F-D14D-A31A-C31C4D124FCD}\InprocServer32\ = "C:\\Windows\\SysWow64\\arjrkler.dll"	7b65f3b2f451ca36d1f2ae8f797b7ca5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DC69134A-F15F-D14D-A31A-C31C4D124FCD}\InprocServer32\ThreadingModel = "Apartment"	mkjraler.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DC69134A-F15F-D14D-A31A-C31C4D124FCD}\InprocServer32\ThreadingModel = "Apartment"	mkjraler.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DC69134A-F15F-D14D-A31A-C31C4D124FCD}\InprocServer32\ThreadingModel = "Apartment"	mkjraler.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DC69134A-F15F-D14D-A31A-C31C4D124FCD}\InprocServer32\ = "C:\\Windows\\SysWow64\\arjrkler.dll"	mkjraler.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	7b65f3b2f451ca36d1f2ae8f797b7ca5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DC69134A-F15F-D14D-A31A-C31C4D124FCD}\InprocServer32\ThreadingModel = "Apartment"	mkjraler.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DC69134A-F15F-D14D-A31A-C31C4D124FCD}\InprocServer32	mkjraler.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DC69134A-F15F-D14D-A31A-C31C4D124FCD}\InprocServer32\ = "C:\\Windows\\SysWow64\\arjrkler.dll"	mkjraler.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DC69134A-F15F-D14D-A31A-C31C4D124FCD}\InprocServer32	7b65f3b2f451ca36d1f2ae8f797b7ca5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DC69134A-F15F-D14D-A31A-C31C4D124FCD}\InprocServer32\ = "C:\\Windows\\SysWow64\\arjrkler.dll"	mkjraler.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DC69134A-F15F-D14D-A31A-C31C4D124FCD}\InprocServer32\ = "C:\\Windows\\SysWow64\\arjrkler.dll"	mkjraler.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DC69134A-F15F-D14D-A31A-C31C4D124FCD}\InprocServer32\ThreadingModel = "Apartment"	mkjraler.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DC69134A-F15F-D14D-A31A-C31C4D124FCD}\InprocServer32	mkjraler.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DC69134A-F15F-D14D-A31A-C31C4D124FCD}\InprocServer32\ThreadingModel = "Apartment"	7b65f3b2f451ca36d1f2ae8f797b7ca5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DC69134A-F15F-D14D-A31A-C31C4D124FCD}\InprocServer32	mkjraler.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DC69134A-F15F-D14D-A31A-C31C4D124FCD}\InprocServer32\ = "C:\\Windows\\SysWow64\\arjrkler.dll"	mkjraler.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DC69134A-F15F-D14D-A31A-C31C4D124FCD}\InprocServer32	mkjraler.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DC69134A-F15F-D14D-A31A-C31C4D124FCD}\InprocServer32\ThreadingModel = "Apartment"	mkjraler.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DC69134A-F15F-D14D-A31A-C31C4D124FCD}	7b65f3b2f451ca36d1f2ae8f797b7ca5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DC69134A-F15F-D14D-A31A-C31C4D124FCD}\InprocServer32	mkjraler.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DC69134A-F15F-D14D-A31A-C31C4D124FCD}\InprocServer32	mkjraler.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DC69134A-F15F-D14D-A31A-C31C4D124FCD}\InprocServer32	mkjraler.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DC69134A-F15F-D14D-A31A-C31C4D124FCD}\InprocServer32\ = "C:\\Windows\\SysWow64\\arjrkler.dll"	mkjraler.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DC69134A-F15F-D14D-A31A-C31C4D124FCD}\InprocServer32\ = "C:\\Windows\\SysWow64\\arjrkler.dll"	mkjraler.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DC69134A-F15F-D14D-A31A-C31C4D124FCD}\InprocServer32\ThreadingModel = "Apartment"	mkjraler.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DC69134A-F15F-D14D-A31A-C31C4D124FCD}\InprocServer32\ThreadingModel = "Apartment"	mkjraler.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DC69134A-F15F-D14D-A31A-C31C4D124FCD}\InprocServer32	mkjraler.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DC69134A-F15F-D14D-A31A-C31C4D124FCD}\InprocServer32\ = "C:\\Windows\\SysWow64\\arjrkler.dll"	mkjraler.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
4320	7b65f3b2f451ca36d1f2ae8f797b7ca5.exe
4320	7b65f3b2f451ca36d1f2ae8f797b7ca5.exe
5612	mkjraler.exe
5612	mkjraler.exe
7592	mkjraler.exe
7592	mkjraler.exe
10396	mkjraler.exe
10396	mkjraler.exe
8132	mkjraler.exe
8132	mkjraler.exe
11040	mkjraler.exe
11040	mkjraler.exe
3792	mkjraler.exe
3792	mkjraler.exe
4348	mkjraler.exe
4348	mkjraler.exe
8936	mkjraler.exe
8936	mkjraler.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	4320	7b65f3b2f451ca36d1f2ae8f797b7ca5.exe
Token: SeDebugPrivilege	5612	mkjraler.exe
Token: SeDebugPrivilege	7592	mkjraler.exe
Token: SeDebugPrivilege	10396	mkjraler.exe
Token: SeDebugPrivilege	8132	mkjraler.exe
Token: SeDebugPrivilege	11040	mkjraler.exe
Token: SeDebugPrivilege	3792	mkjraler.exe
Token: SeDebugPrivilege	4348	mkjraler.exe
Token: SeDebugPrivilege	8936	mkjraler.exe

Suspicious use of WriteProcessMemory 57 IoCs

description	pid	Process	procid_target
PID 4320 wrote to memory of 4976	4320	7b65f3b2f451ca36d1f2ae8f797b7ca5.exe	85
PID 4320 wrote to memory of 4976	4320	7b65f3b2f451ca36d1f2ae8f797b7ca5.exe	85
PID 4320 wrote to memory of 4976	4320	7b65f3b2f451ca36d1f2ae8f797b7ca5.exe	85
PID 4320 wrote to memory of 5612	4320	7b65f3b2f451ca36d1f2ae8f797b7ca5.exe	87
PID 4320 wrote to memory of 5612	4320	7b65f3b2f451ca36d1f2ae8f797b7ca5.exe	87
PID 4320 wrote to memory of 5612	4320	7b65f3b2f451ca36d1f2ae8f797b7ca5.exe	87
PID 5612 wrote to memory of 5652	5612	mkjraler.exe	88
PID 5612 wrote to memory of 5652	5612	mkjraler.exe	88
PID 5612 wrote to memory of 5652	5612	mkjraler.exe	88
PID 5612 wrote to memory of 7592	5612	mkjraler.exe	89
PID 5612 wrote to memory of 7592	5612	mkjraler.exe	89
PID 5612 wrote to memory of 7592	5612	mkjraler.exe	89
PID 7592 wrote to memory of 7628	7592	mkjraler.exe	101
PID 7592 wrote to memory of 7628	7592	mkjraler.exe	101
PID 7592 wrote to memory of 7628	7592	mkjraler.exe	101
PID 7592 wrote to memory of 10396	7592	mkjraler.exe	100
PID 7592 wrote to memory of 10396	7592	mkjraler.exe	100
PID 7592 wrote to memory of 10396	7592	mkjraler.exe	100
PID 10396 wrote to memory of 10428	10396	mkjraler.exe	97
PID 10396 wrote to memory of 10428	10396	mkjraler.exe	97
PID 10396 wrote to memory of 10428	10396	mkjraler.exe	97
PID 10396 wrote to memory of 8132	10396	mkjraler.exe	96
PID 10396 wrote to memory of 8132	10396	mkjraler.exe	96
PID 10396 wrote to memory of 8132	10396	mkjraler.exe	96
PID 8132 wrote to memory of 8352	8132	mkjraler.exe	92
PID 8132 wrote to memory of 8352	8132	mkjraler.exe	92
PID 8132 wrote to memory of 8352	8132	mkjraler.exe	92
PID 8132 wrote to memory of 11040	8132	mkjraler.exe	95
PID 8132 wrote to memory of 11040	8132	mkjraler.exe	95
PID 8132 wrote to memory of 11040	8132	mkjraler.exe	95
PID 11040 wrote to memory of 11072	11040	mkjraler.exe	94
PID 11040 wrote to memory of 11072	11040	mkjraler.exe	94
PID 11040 wrote to memory of 11072	11040	mkjraler.exe	94
PID 11040 wrote to memory of 3792	11040	mkjraler.exe	98
PID 11040 wrote to memory of 3792	11040	mkjraler.exe	98
PID 11040 wrote to memory of 3792	11040	mkjraler.exe	98
PID 3792 wrote to memory of 704	3792	mkjraler.exe	103
PID 3792 wrote to memory of 704	3792	mkjraler.exe	103
PID 3792 wrote to memory of 704	3792	mkjraler.exe	103
PID 3792 wrote to memory of 4348	3792	mkjraler.exe	105
PID 3792 wrote to memory of 4348	3792	mkjraler.exe	105
PID 3792 wrote to memory of 4348	3792	mkjraler.exe	105
PID 4348 wrote to memory of 2268	4348	mkjraler.exe	106
PID 4348 wrote to memory of 2268	4348	mkjraler.exe	106
PID 4348 wrote to memory of 2268	4348	mkjraler.exe	106
PID 4348 wrote to memory of 8936	4348	mkjraler.exe	108
PID 4348 wrote to memory of 8936	4348	mkjraler.exe	108
PID 4348 wrote to memory of 8936	4348	mkjraler.exe	108
PID 8936 wrote to memory of 8988	8936	mkjraler.exe	109
PID 8936 wrote to memory of 8988	8936	mkjraler.exe	109
PID 8936 wrote to memory of 8988	8936	mkjraler.exe	109
PID 8936 wrote to memory of 7532	8936	mkjraler.exe	110
PID 8936 wrote to memory of 7532	8936	mkjraler.exe	110
PID 8936 wrote to memory of 7532	8936	mkjraler.exe	110
PID 7532 wrote to memory of 7584	7532	mkjraler.exe	121
PID 7532 wrote to memory of 7584	7532	mkjraler.exe	121
PID 7532 wrote to memory of 7584	7532	mkjraler.exe	121

C:\Users\Admin\AppData\Local\Temp\7b65f3b2f451ca36d1f2ae8f797b7ca5.exe
"C:\Users\Admin\AppData\Local\Temp\7b65f3b2f451ca36d1f2ae8f797b7ca5.exe"
1⤵
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4320
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240603281.bat
  2⤵
  PID:4976
- C:\Windows\SysWOW64\mkjraler.exe
  C:\Windows\system32\mkjraler.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5612
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240603625.bat
    3⤵
    PID:5652
- - C:\Windows\SysWOW64\mkjraler.exe
    C:\Windows\system32\mkjraler.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:7592
  - - C:\Windows\SysWOW64\mkjraler.exe
      C:\Windows\system32\mkjraler.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:10396
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240634906.bat
        5⤵
        
        PID:14396
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240603765.bat
      4⤵
      PID:7628
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240634515.bat
      4⤵
      PID:9340
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240634312.bat
    3⤵
    PID:11768
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240634187.bat
  2⤵
  PID:15272

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240604234.bat
1⤵
PID:8352

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240604546.bat
1⤵
PID:11072

C:\Windows\SysWOW64\mkjraler.exe
C:\Windows\system32\mkjraler.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:11040
- C:\Windows\SysWOW64\mkjraler.exe
  C:\Windows\system32\mkjraler.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3792
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240604984.bat
    3⤵
    PID:704
- - C:\Windows\SysWOW64\mkjraler.exe
    C:\Windows\system32\mkjraler.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4348
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240605187.bat
      4⤵
      PID:2268
  - - C:\Windows\SysWOW64\mkjraler.exe
      C:\Windows\system32\mkjraler.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:8936
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240605484.bat
        5⤵
        
        PID:8988
    - - C:\Windows\SysWOW64\mkjraler.exe
        
        C:\Windows\system32\mkjraler.exe
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:7532
      - C:\Windows\SysWOW64\mkjraler.exe
        
        C:\Windows\system32\mkjraler.exe
        6⤵
        
        PID:5648
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240636750.bat
        7⤵
        
        PID:14760
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240605750.bat
        6⤵
        
        PID:7584
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240636593.bat
        6⤵
        
        PID:2640
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240636375.bat
        5⤵
        
        PID:15448
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240636031.bat
      4⤵
      PID:8312
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240635781.bat
    3⤵
    PID:13948
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240635515.bat
  2⤵
  PID:11484

C:\Windows\SysWOW64\mkjraler.exe
C:\Windows\system32\mkjraler.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:8132
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240635140.bat
  2⤵
  PID:13360

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240603953.bat
1⤵
PID:10428

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240606000.bat
1⤵
PID:5916

C:\Windows\SysWOW64\mkjraler.exe
C:\Windows\system32\mkjraler.exe
1⤵
PID:3588
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240606234.bat
  2⤵
  PID:5948
- C:\Windows\SysWOW64\mkjraler.exe
  C:\Windows\system32\mkjraler.exe
  2⤵
  PID:10944
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240606546.bat
    3⤵
    PID:10872
- - C:\Windows\SysWOW64\mkjraler.exe
    C:\Windows\system32\mkjraler.exe
    3⤵
    PID:6928
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240606750.bat
      4⤵
      PID:10060
  - - C:\Windows\SysWOW64\mkjraler.exe
      C:\Windows\system32\mkjraler.exe
      4⤵
      PID:11172
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240607078.bat
        5⤵
        
        PID:11216
    - - C:\Windows\SysWOW64\mkjraler.exe
        
        C:\Windows\system32\mkjraler.exe
        5⤵
        
        PID:7836
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240607296.bat
        6⤵
        
        PID:5408
      - C:\Windows\SysWOW64\mkjraler.exe
        
        C:\Windows\system32\mkjraler.exe
        6⤵
        
        PID:7896
        
        C:\Windows\SysWOW64\mkjraler.exe
        
        C:\Windows\system32\mkjraler.exe
        7⤵
        
        PID:4468
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240607859.bat
        8⤵
        
        PID:10052
        
        C:\Windows\SysWOW64\mkjraler.exe
        
        C:\Windows\system32\mkjraler.exe
        8⤵
        
        PID:5440
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240608109.bat
        9⤵
        
        PID:9416
        
        C:\Windows\SysWOW64\mkjraler.exe
        
        C:\Windows\system32\mkjraler.exe
        9⤵
        
        PID:5688
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240608781.bat
        10⤵
        
        PID:3112
        
        C:\Windows\SysWOW64\mkjraler.exe
        
        C:\Windows\system32\mkjraler.exe
        10⤵
        
        PID:4544
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240609109.bat
        11⤵
        
        PID:3892
        
        C:\Windows\SysWOW64\mkjraler.exe
        
        C:\Windows\system32\mkjraler.exe
        11⤵
        
        PID:5592
        
        C:\Windows\SysWOW64\mkjraler.exe
        
        C:\Windows\system32\mkjraler.exe
        12⤵
        
        PID:8148
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240609703.bat
        13⤵
        
        PID:6872
        
        C:\Windows\SysWOW64\mkjraler.exe
        
        C:\Windows\system32\mkjraler.exe
        13⤵
        
        PID:8208
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240609953.bat
        14⤵
        
        PID:9644
        
        C:\Windows\SysWOW64\mkjraler.exe
        
        C:\Windows\system32\mkjraler.exe
        14⤵
        
        PID:10692
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240610250.bat
        15⤵
        
        PID:9392
        
        C:\Windows\SysWOW64\mkjraler.exe
        
        C:\Windows\system32\mkjraler.exe
        15⤵
        
        PID:7260
        
        C:\Windows\SysWOW64\mkjraler.exe
        
        C:\Windows\system32\mkjraler.exe
        16⤵
        
        PID:8600
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240610734.bat
        17⤵
        
        PID:7800
        
        C:\Windows\SysWOW64\mkjraler.exe
        
        C:\Windows\system32\mkjraler.exe
        17⤵
        
        PID:4420
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240611000.bat
        18⤵
        
        PID:4908
        
        C:\Windows\SysWOW64\mkjraler.exe
        
        C:\Windows\system32\mkjraler.exe
        18⤵
        
        PID:10756
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240611281.bat
        19⤵
        
        PID:9196
        
        C:\Windows\SysWOW64\mkjraler.exe
        
        C:\Windows\system32\mkjraler.exe
        19⤵
        
        PID:8024
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240611531.bat
        20⤵
        
        PID:9480
        
        C:\Windows\SysWOW64\mkjraler.exe
        
        C:\Windows\system32\mkjraler.exe
        20⤵
        
        PID:4808
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240611796.bat
        21⤵
        
        PID:2768
        
        C:\Windows\SysWOW64\mkjraler.exe
        
        C:\Windows\system32\mkjraler.exe
        21⤵
        
        PID:5244
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240611953.bat
        22⤵
        
        PID:10012
        
        C:\Windows\SysWOW64\mkjraler.exe
        
        C:\Windows\system32\mkjraler.exe
        22⤵
        
        PID:8260
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240612281.bat
        23⤵
        
        PID:9728
        
        C:\Windows\SysWOW64\mkjraler.exe
        
        C:\Windows\system32\mkjraler.exe
        23⤵
        
        PID:9980
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240612468.bat
        24⤵
        
        PID:7672
        
        C:\Windows\SysWOW64\mkjraler.exe
        
        C:\Windows\system32\mkjraler.exe
        24⤵
        
        PID:8864
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240612734.bat
        25⤵
        
        PID:1100
        
        C:\Windows\SysWOW64\mkjraler.exe
        
        C:\Windows\system32\mkjraler.exe
        25⤵
        
        PID:10644
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240613093.bat
        26⤵
        
        PID:10600
        
        C:\Windows\SysWOW64\mkjraler.exe
        
        C:\Windows\system32\mkjraler.exe
        26⤵
        
        PID:7160
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240613656.bat
        27⤵
        
        PID:6452
        
        C:\Windows\SysWOW64\mkjraler.exe
        
        C:\Windows\system32\mkjraler.exe
        27⤵
        
        PID:12236
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240613984.bat
        28⤵
        
        PID:11512
        
        C:\Windows\SysWOW64\mkjraler.exe
        
        C:\Windows\system32\mkjraler.exe
        28⤵
        
        PID:9256
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240614281.bat
        29⤵
        
        PID:7144
        
        C:\Windows\SysWOW64\mkjraler.exe
        
        C:\Windows\system32\mkjraler.exe
        29⤵
        
        PID:5360
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240614546.bat
        30⤵
        
        PID:1048
        
        C:\Windows\SysWOW64\mkjraler.exe
        
        C:\Windows\system32\mkjraler.exe
        30⤵
        
        PID:10472
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240614937.bat
        31⤵
        
        PID:11540
        
        C:\Windows\SysWOW64\mkjraler.exe
        
        C:\Windows\system32\mkjraler.exe
        31⤵
        
        PID:5396
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240615218.bat
        32⤵
        
        PID:9876
        
        C:\Windows\SysWOW64\mkjraler.exe
        
        C:\Windows\system32\mkjraler.exe
        32⤵
        
        PID:3640
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240615484.bat
        33⤵
        
        PID:6280
        
        C:\Windows\SysWOW64\mkjraler.exe
        
        C:\Windows\system32\mkjraler.exe
        33⤵
        
        PID:972
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240615671.bat
        34⤵
        
        PID:3232
        
        C:\Windows\SysWOW64\mkjraler.exe
        
        C:\Windows\system32\mkjraler.exe
        34⤵
        
        PID:11332
        
        C:\Windows\SysWOW64\mkjraler.exe
        
        C:\Windows\system32\mkjraler.exe
        35⤵
        
        PID:10904
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240616218.bat
        36⤵
        
        PID:9152
        
        C:\Windows\SysWOW64\mkjraler.exe
        
        C:\Windows\system32\mkjraler.exe
        36⤵
        
        PID:12152
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240616406.bat
        37⤵
        
        PID:12092
        
        C:\Windows\SysWOW64\mkjraler.exe
        
        C:\Windows\system32\mkjraler.exe
        37⤵
        
        PID:12216
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240616734.bat
        38⤵
        
        PID:10560
        
        C:\Windows\SysWOW64\mkjraler.exe
        
        C:\Windows\system32\mkjraler.exe
        38⤵
        
        PID:8056
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240617062.bat
        39⤵
        
        PID:8392
        
        C:\Windows\SysWOW64\mkjraler.exe
        
        C:\Windows\system32\mkjraler.exe
        39⤵
        
        PID:2072
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240617390.bat
        40⤵
        
        PID:2612
        
        C:\Windows\SysWOW64\mkjraler.exe
        
        C:\Windows\system32\mkjraler.exe
        40⤵
        
        PID:2124
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240617703.bat
        41⤵
        
        PID:6588
        
        C:\Windows\SysWOW64\mkjraler.exe
        
        C:\Windows\system32\mkjraler.exe
        41⤵
        
        PID:11884
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240618015.bat
        42⤵
        
        PID:8532
        
        C:\Windows\SysWOW64\mkjraler.exe
        
        C:\Windows\system32\mkjraler.exe
        42⤵
        
        PID:6320
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240618296.bat
        43⤵
        
        PID:8636
        
        C:\Windows\SysWOW64\mkjraler.exe
        
        C:\Windows\system32\mkjraler.exe
        43⤵
        
        PID:1288
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240618531.bat
        44⤵
        
        PID:8812
        
        C:\Windows\SysWOW64\mkjraler.exe
        
        C:\Windows\system32\mkjraler.exe
        44⤵
        
        PID:11732
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240618781.bat
        45⤵
        
        PID:6644
        
        C:\Windows\SysWOW64\mkjraler.exe
        
        C:\Windows\system32\mkjraler.exe
        45⤵
        
        PID:10816
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240619140.bat
        46⤵
        
        PID:8944
        
        C:\Windows\SysWOW64\mkjraler.exe
        
        C:\Windows\system32\mkjraler.exe
        46⤵
        
        PID:11572
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240619375.bat
        47⤵
        
        PID:11424
        
        C:\Windows\SysWOW64\mkjraler.exe
        
        C:\Windows\system32\mkjraler.exe
        47⤵
        
        PID:6040
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240619609.bat
        48⤵
        
        PID:5856
        
        C:\Windows\SysWOW64\mkjraler.exe
        
        C:\Windows\system32\mkjraler.exe
        48⤵
        
        PID:6876
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240619968.bat
        49⤵
        
        PID:6540
        
        C:\Windows\SysWOW64\mkjraler.exe
        
        C:\Windows\system32\mkjraler.exe
        49⤵
        
        PID:5580
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240620171.bat
        50⤵
        
        PID:11720
        
        C:\Windows\SysWOW64\mkjraler.exe
        
        C:\Windows\system32\mkjraler.exe
        50⤵
        
        PID:5728
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240620468.bat
        51⤵
        
        PID:11932
        
        C:\Windows\SysWOW64\mkjraler.exe
        
        C:\Windows\system32\mkjraler.exe
        51⤵
        
        PID:2684
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240620750.bat
        52⤵
        
        PID:5492
        
        C:\Windows\SysWOW64\mkjraler.exe
        
        C:\Windows\system32\mkjraler.exe
        52⤵
        
        PID:1956
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240621015.bat
        53⤵
        
        PID:12492
        
        C:\Windows\SysWOW64\mkjraler.exe
        
        C:\Windows\system32\mkjraler.exe
        53⤵
        
        PID:7700
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240621281.bat
        54⤵
        
        PID:4872
        
        C:\Windows\SysWOW64\mkjraler.exe
        
        C:\Windows\system32\mkjraler.exe
        54⤵
        
        PID:9244
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240621500.bat
        55⤵
        
        PID:7916
        
        C:\Windows\SysWOW64\mkjraler.exe
        
        C:\Windows\system32\mkjraler.exe
        55⤵
        
        PID:1208
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240621781.bat
        56⤵
        
        PID:7972
        
        C:\Windows\SysWOW64\mkjraler.exe
        
        C:\Windows\system32\mkjraler.exe
        56⤵
        
        PID:12964
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240622109.bat
        57⤵
        
        PID:9424
        
        C:\Windows\SysWOW64\mkjraler.exe
        
        C:\Windows\system32\mkjraler.exe
        57⤵
        
        PID:12252
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240622390.bat
        58⤵
        
        PID:8388
        
        C:\Windows\SysWOW64\mkjraler.exe
        
        C:\Windows\system32\mkjraler.exe
        58⤵
        
        PID:6444
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240622750.bat
        59⤵
        
        PID:5788
        
        C:\Windows\SysWOW64\mkjraler.exe
        
        C:\Windows\system32\mkjraler.exe
        59⤵
        
        PID:11684
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240623109.bat
        60⤵
        
        PID:3352
        
        C:\Windows\SysWOW64\mkjraler.exe
        
        C:\Windows\system32\mkjraler.exe
        60⤵
        
        PID:4492
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240623421.bat
        61⤵
        
        PID:9992
        
        C:\Windows\SysWOW64\mkjraler.exe
        
        C:\Windows\system32\mkjraler.exe
        61⤵
        
        PID:3276
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240623703.bat
        62⤵
        
        PID:1756
        
        C:\Windows\SysWOW64\mkjraler.exe
        
        C:\Windows\system32\mkjraler.exe
        62⤵
        
        PID:9984
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240624031.bat
        63⤵
        
        PID:12028
        
        C:\Windows\SysWOW64\mkjraler.exe
        
        C:\Windows\system32\mkjraler.exe
        63⤵
        
        PID:5316
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240624281.bat
        64⤵
        
        PID:12360
        
        C:\Windows\SysWOW64\mkjraler.exe
        
        C:\Windows\system32\mkjraler.exe
        64⤵
        
        PID:12164
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240624484.bat
        65⤵
        
        PID:6332
        
        C:\Windows\SysWOW64\mkjraler.exe
        
        C:\Windows\system32\mkjraler.exe
        65⤵
        
        PID:10768
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240624750.bat
        66⤵
        
        PID:11968
        
        C:\Windows\SysWOW64\mkjraler.exe
        
        C:\Windows\system32\mkjraler.exe
        66⤵
        
        PID:10264
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240625046.bat
        67⤵
        
        PID:13140
        
        C:\Windows\SysWOW64\mkjraler.exe
        
        C:\Windows\system32\mkjraler.exe
        67⤵
        
        PID:7928
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240625437.bat
        68⤵
        
        PID:7368
        
        C:\Windows\SysWOW64\mkjraler.exe
        
        C:\Windows\system32\mkjraler.exe
        68⤵
        
        PID:7792
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240625734.bat
        69⤵
        
        PID:6724
        
        C:\Windows\SysWOW64\mkjraler.exe
        
        C:\Windows\system32\mkjraler.exe
        69⤵
        
        PID:3084
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240625984.bat
        70⤵
        
        PID:10956
        
        C:\Windows\SysWOW64\mkjraler.exe
        
        C:\Windows\system32\mkjraler.exe
        70⤵
        
        PID:9584
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240626218.bat
        71⤵
        
        PID:12864
        
        C:\Windows\SysWOW64\mkjraler.exe
        
        C:\Windows\system32\mkjraler.exe
        71⤵
        
        PID:8712
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240626515.bat
        72⤵
        
        PID:12836
        
        C:\Windows\SysWOW64\mkjraler.exe
        
        C:\Windows\system32\mkjraler.exe
        72⤵
        
        PID:8544
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240626765.bat
        73⤵
        
        PID:10820
        
        C:\Windows\SysWOW64\mkjraler.exe
        
        C:\Windows\system32\mkjraler.exe
        73⤵
        
        PID:7500
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240627000.bat
        74⤵
        
        PID:13044
        
        C:\Windows\SysWOW64\mkjraler.exe
        
        C:\Windows\system32\mkjraler.exe
        74⤵
        
        PID:4668
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240627281.bat
        75⤵
        
        PID:5760
        
        C:\Windows\SysWOW64\mkjraler.exe
        
        C:\Windows\system32\mkjraler.exe
        75⤵
        
        PID:12640
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240627562.bat
        76⤵
        
        PID:12556
        
        C:\Windows\SysWOW64\mkjraler.exe
        
        C:\Windows\system32\mkjraler.exe
        76⤵
        
        PID:4724
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240627828.bat
        77⤵
        
        PID:5972
        
        C:\Windows\SysWOW64\mkjraler.exe
        
        C:\Windows\system32\mkjraler.exe
        77⤵
        
        PID:6908
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240628203.bat
        78⤵
        
        PID:10000
        
        C:\Windows\SysWOW64\mkjraler.exe
        
        C:\Windows\system32\mkjraler.exe
        78⤵
        
        PID:7772
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240628437.bat
        79⤵
        
        PID:1608
        
        C:\Windows\SysWOW64\mkjraler.exe
        
        C:\Windows\system32\mkjraler.exe
        79⤵
        
        PID:9592
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240628593.bat
        80⤵
        
        PID:8268
        
        C:\Windows\SysWOW64\mkjraler.exe
        
        C:\Windows\system32\mkjraler.exe
        80⤵
        
        PID:16020
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240629171.bat
        81⤵
        
        PID:16052
        
        C:\Windows\SysWOW64\mkjraler.exe
        
        C:\Windows\system32\mkjraler.exe
        81⤵
        
        PID:7312
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240629453.bat
        82⤵
        
        PID:10608
        
        C:\Windows\SysWOW64\mkjraler.exe
        
        C:\Windows\system32\mkjraler.exe
        82⤵
        
        PID:15740
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240629750.bat
        83⤵
        
        PID:15768
        
        C:\Windows\SysWOW64\mkjraler.exe
        
        C:\Windows\system32\mkjraler.exe
        83⤵
        
        PID:13132
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240630046.bat
        84⤵
        
        PID:12392
        
        C:\Windows\SysWOW64\mkjraler.exe
        
        C:\Windows\system32\mkjraler.exe
        84⤵
        
        PID:13988
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240630390.bat
        85⤵
        
        PID:16328
        
        C:\Windows\SysWOW64\mkjraler.exe
        
        C:\Windows\system32\mkjraler.exe
        85⤵
        
        PID:10800
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240630625.bat
        86⤵
        
        PID:8748
        
        C:\Windows\SysWOW64\mkjraler.exe
        
        C:\Windows\system32\mkjraler.exe
        86⤵
        
        PID:14392
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240630890.bat
        87⤵
        
        PID:14356
        
        C:\Windows\SysWOW64\mkjraler.exe
        
        C:\Windows\system32\mkjraler.exe
        87⤵
        
        PID:9936
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240631234.bat
        88⤵
        
        PID:8044
        
        C:\Windows\SysWOW64\mkjraler.exe
        
        C:\Windows\system32\mkjraler.exe
        88⤵
        
        PID:8704
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240631484.bat
        89⤵
        
        PID:5140
        
        C:\Windows\SysWOW64\mkjraler.exe
        
        C:\Windows\system32\mkjraler.exe
        89⤵
        
        PID:15560
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240631828.bat
        90⤵
        
        PID:15684
        
        C:\Windows\SysWOW64\mkjraler.exe
        
        C:\Windows\system32\mkjraler.exe
        90⤵
        
        PID:5220
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240632109.bat
        91⤵
        
        PID:9508
        
        C:\Windows\SysWOW64\mkjraler.exe
        
        C:\Windows\system32\mkjraler.exe
        91⤵
        
        PID:15164
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240632468.bat
        92⤵
        
        PID:15192
        
        C:\Windows\SysWOW64\mkjraler.exe
        
        C:\Windows\system32\mkjraler.exe
        92⤵
        
        PID:12648
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240632671.bat
        93⤵
        
        PID:7140
        
        C:\Windows\SysWOW64\mkjraler.exe
        
        C:\Windows\system32\mkjraler.exe
        93⤵
        
        PID:15108
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240633015.bat
        94⤵
        
        PID:16080
        
        C:\Windows\SysWOW64\mkjraler.exe
        
        C:\Windows\system32\mkjraler.exe
        94⤵
        
        PID:2924
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240633281.bat
        95⤵
        
        PID:3312
        
        C:\Windows\SysWOW64\mkjraler.exe
        
        C:\Windows\system32\mkjraler.exe
        95⤵
        
        PID:13192
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240633703.bat
        96⤵
        
        PID:12988
        
        C:\Windows\SysWOW64\mkjraler.exe
        
        C:\Windows\system32\mkjraler.exe
        96⤵
        
        PID:14588
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240633921.bat
        97⤵
        
        PID:14544
        
        C:\Windows\SysWOW64\mkjraler.exe
        
        C:\Windows\system32\mkjraler.exe
        97⤵
        
        PID:16240
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240634171.bat
        98⤵
        
        PID:16164
        
        C:\Windows\SysWOW64\mkjraler.exe
        
        C:\Windows\system32\mkjraler.exe
        98⤵
        
        PID:9052
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240634531.bat
        99⤵
        
        PID:15496
        
        C:\Windows\SysWOW64\mkjraler.exe
        
        C:\Windows\system32\mkjraler.exe
        99⤵
        
        PID:5252
        
        C:\Windows\SysWOW64\mkjraler.exe
        
        C:\Windows\system32\mkjraler.exe
        100⤵
        
        PID:9488
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240635406.bat
        101⤵
        
        PID:10516
        
        C:\Windows\SysWOW64\mkjraler.exe
        
        C:\Windows\system32\mkjraler.exe
        101⤵
        
        PID:10288
        
        C:\Windows\SysWOW64\mkjraler.exe
        
        C:\Windows\system32\mkjraler.exe
        102⤵
        
        PID:12320
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240636000.bat
        103⤵
        
        PID:552
        
        C:\Windows\SysWOW64\mkjraler.exe
        
        C:\Windows\system32\mkjraler.exe
        103⤵
        
        PID:6892
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240636234.bat
        104⤵
        
        PID:7436
        
        C:\Windows\SysWOW64\mkjraler.exe
        
        C:\Windows\system32\mkjraler.exe
        104⤵
        
        PID:14932
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240636703.bat
        105⤵
        
        PID:9888
        
        C:\Windows\SysWOW64\mkjraler.exe
        
        C:\Windows\system32\mkjraler.exe
        105⤵
        
        PID:9000
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240637015.bat
        106⤵
        
        PID:14400
        
        C:\Windows\SysWOW64\mkjraler.exe
        
        C:\Windows\system32\mkjraler.exe
        106⤵
        
        PID:6480
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240637312.bat
        107⤵
        
        PID:1320
        
        C:\Windows\SysWOW64\mkjraler.exe
        
        C:\Windows\system32\mkjraler.exe
        107⤵
        
        PID:4804
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240637703.bat
        108⤵
        
        PID:13412
        
        C:\Windows\SysWOW64\mkjraler.exe
        
        C:\Windows\system32\mkjraler.exe
        108⤵
        
        PID:15440
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240637890.bat
        109⤵
        
        PID:5668
        
        C:\Windows\SysWOW64\mkjraler.exe
        
        C:\Windows\system32\mkjraler.exe
        109⤵
        
        PID:18140
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240638296.bat
        110⤵
        
        PID:18272
        
        C:\Windows\SysWOW64\mkjraler.exe
        
        C:\Windows\system32\mkjraler.exe
        110⤵
        
        PID:12948
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240638718.bat
        111⤵
        
        PID:15776
        
        C:\Windows\SysWOW64\mkjraler.exe
        
        C:\Windows\system32\mkjraler.exe
        111⤵
        
        PID:18360
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240639015.bat
        112⤵
        
        PID:10636
        
        C:\Windows\SysWOW64\mkjraler.exe
        
        C:\Windows\system32\mkjraler.exe
        112⤵
        
        PID:4384
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240639312.bat
        113⤵
        
        PID:12672
        
        C:\Windows\SysWOW64\mkjraler.exe
        
        C:\Windows\system32\mkjraler.exe
        113⤵
        
        PID:14340
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240639687.bat
        114⤵
        
        PID:5872
        
        C:\Windows\SysWOW64\mkjraler.exe
        
        C:\Windows\system32\mkjraler.exe
        114⤵
        
        PID:5488
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240639953.bat
        115⤵
        
        PID:16212
        
        C:\Windows\SysWOW64\mkjraler.exe
        
        C:\Windows\system32\mkjraler.exe
        115⤵
        
        PID:13532
        
        C:\Windows\SysWOW64\mkjraler.exe
        
        C:\Windows\system32\mkjraler.exe
        116⤵
        
        PID:9248
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240640562.bat
        117⤵
        
        PID:15568
        
        C:\Windows\SysWOW64\mkjraler.exe
        
        C:\Windows\system32\mkjraler.exe
        117⤵
        
        PID:13848
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240641156.bat
        118⤵
        
        PID:7824
        
        C:\Windows\SysWOW64\mkjraler.exe
        
        C:\Windows\system32\mkjraler.exe
        118⤵
        
        PID:3544
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240641578.bat
        119⤵
        
        PID:9252
        
        C:\Windows\SysWOW64\mkjraler.exe
        
        C:\Windows\system32\mkjraler.exe
        119⤵
        
        PID:13996
        
        C:\Windows\SysWOW64\mkjraler.exe
        
        C:\Windows\system32\mkjraler.exe
        120⤵
        
        PID:14056
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240642265.bat
        121⤵
        
        PID:17316
        
        C:\Windows\SysWOW64\mkjraler.exe
        
        C:\Windows\system32\mkjraler.exe
        121⤵
        
        PID:10156
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240642718.bat
        122⤵
        
        PID:10028
        
        C:\Windows\SysWOW64\mkjraler.exe
        
        C:\Windows\system32\mkjraler.exe
        122⤵
        
        PID:15456
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240643203.bat
        123⤵
        
        PID:10540
        
        C:\Windows\SysWOW64\mkjraler.exe
        
        C:\Windows\system32\mkjraler.exe
        123⤵
        
        PID:632
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240643500.bat
        124⤵
        
        PID:18032
        
        C:\Windows\SysWOW64\mkjraler.exe
        
        C:\Windows\system32\mkjraler.exe
        124⤵
        
        PID:10748
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240643828.bat
        125⤵
        
        PID:14764
        
        C:\Windows\SysWOW64\mkjraler.exe
        
        C:\Windows\system32\mkjraler.exe
        125⤵
        
        PID:6400
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240644281.bat
        126⤵
        
        PID:9380
        
        C:\Windows\SysWOW64\mkjraler.exe
        
        C:\Windows\system32\mkjraler.exe
        126⤵
        
        PID:6844
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240644593.bat
        127⤵
        
        PID:17956
        
        C:\Windows\SysWOW64\mkjraler.exe
        
        C:\Windows\system32\mkjraler.exe
        127⤵
        
        PID:17144
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240645046.bat
        128⤵
        
        PID:15004
        
        C:\Windows\SysWOW64\mkjraler.exe
        
        C:\Windows\system32\mkjraler.exe
        128⤵
        
        PID:4700
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240646140.bat
        129⤵
        
        PID:6428
        
        C:\Windows\SysWOW64\mkjraler.exe
        
        C:\Windows\system32\mkjraler.exe
        129⤵
        
        PID:16516
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240646578.bat
        130⤵
        
        PID:6232
        
        C:\Windows\SysWOW64\mkjraler.exe
        
        C:\Windows\system32\mkjraler.exe
        130⤵
        
        PID:13696
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240653671.bat
        59⤵
        
        PID:16048
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240653296.bat
        58⤵
        
        PID:13700
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240652984.bat
        57⤵
        
        PID:7768
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240652703.bat
        56⤵
        
        PID:15268
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240652343.bat
        55⤵
        
        PID:3572
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240652078.bat
        54⤵
        
        PID:7084
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240651984.bat
        53⤵
        
        PID:17964
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240651765.bat
        52⤵
        
        PID:11572
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240651406.bat
        51⤵
        
        PID:648
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240651171.bat
        50⤵
        
        PID:16540
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240650765.bat
        49⤵
        
        PID:17728
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240650515.bat
        48⤵
        
        PID:12040
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240650234.bat
        47⤵
        
        PID:17680
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240649921.bat
        46⤵
        
        PID:10356
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240649718.bat
        45⤵
        
        PID:6928
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240649359.bat
        44⤵
        
        PID:7016
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240649125.bat
        43⤵
        
        PID:8956
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240648875.bat
        42⤵
        
        PID:12856
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240648671.bat
        41⤵
        
        PID:13636
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240648359.bat
        40⤵
        
        PID:16104
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240648078.bat
        39⤵
        
        PID:7600
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240647609.bat
        38⤵
        
        PID:15912
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240647281.bat
        37⤵
        
        PID:12452
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240647140.bat
        36⤵
        
        PID:17544
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240646734.bat
        34⤵
        
        PID:17152
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240646562.bat
        33⤵
        
        PID:11268
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240646312.bat
        32⤵
        
        PID:14692
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240646171.bat
        31⤵
        
        PID:13796
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240646187.bat
        30⤵
        
        PID:15248
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240645140.bat
        29⤵
        
        PID:7896
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240644843.bat
        28⤵
        
        PID:436
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240644562.bat
        27⤵
        
        PID:7388
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240644078.bat
        26⤵
        
        PID:8808
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240643687.bat
        25⤵
        
        PID:14696
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240643234.bat
        24⤵
        
        PID:4412
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240643062.bat
        23⤵
        
        PID:17936
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240642906.bat
        22⤵
        
        PID:17184
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240642640.bat
        21⤵
        
        PID:4616
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240642359.bat
        20⤵
        
        PID:10096
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240642156.bat
        19⤵
        
        PID:18340
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240641812.bat
        18⤵
        
        PID:12564
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240641578.bat
        17⤵
        
        PID:15056
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240641250.bat
        16⤵
        
        PID:1508
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240640984.bat
        15⤵
        
        PID:5820
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240640750.bat
        14⤵
        
        PID:12816
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240640546.bat
        13⤵
        
        PID:7032
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240640312.bat
        12⤵
        
        PID:13832
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240639984.bat
        11⤵
        
        PID:16932
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240639625.bat
        10⤵
        
        PID:3236
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240639343.bat
        9⤵
        
        PID:17396
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240638687.bat
        8⤵
        
        PID:11140
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240607546.bat
        7⤵
        
        PID:10160
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240638437.bat
        7⤵
        
        PID:6084
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240638234.bat
        6⤵
        
        PID:18200
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240638000.bat
        5⤵
        
        PID:17264
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240637656.bat
      4⤵
      PID:3108
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240637328.bat
    3⤵
    PID:11384
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240637000.bat
  2⤵
  PID:9748

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240609421.bat
1⤵
PID:9088

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240610437.bat
1⤵
PID:5600

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240615937.bat
1⤵
PID:5164

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240634984.bat
1⤵
PID:7172

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240635671.bat
1⤵
PID:5096

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240640234.bat
1⤵
PID:13372

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240641890.bat
1⤵
PID:2408

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240647328.bat
1⤵
PID:5080

C:\Windows\SysWOW64\mkjraler.exe
C:\Windows\system32\mkjraler.exe
1⤵
PID:16896
- C:\Windows\SysWOW64\mkjraler.exe
  C:\Windows\system32\mkjraler.exe
  2⤵
  PID:10020
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240647640.bat
    3⤵
    PID:7404
- - C:\Windows\SysWOW64\mkjraler.exe
    C:\Windows\system32\mkjraler.exe
    3⤵
    PID:4468
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240647953.bat
      4⤵
      PID:14492
  - - C:\Windows\SysWOW64\mkjraler.exe
      C:\Windows\system32\mkjraler.exe
      4⤵
      PID:15612
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240648296.bat
        5⤵
        
        PID:8964
    - - C:\Windows\SysWOW64\mkjraler.exe
        
        C:\Windows\system32\mkjraler.exe
        5⤵
        
        PID:16116
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240648765.bat
        6⤵
        
        PID:12784
      - C:\Windows\SysWOW64\mkjraler.exe
        
        C:\Windows\system32\mkjraler.exe
        6⤵
        
        PID:13772
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240649093.bat
        7⤵
        
        PID:17664
        
        C:\Windows\SysWOW64\mkjraler.exe
        
        C:\Windows\system32\mkjraler.exe
        7⤵
        
        PID:6196
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240649406.bat
        8⤵
        
        PID:8844
        
        C:\Windows\SysWOW64\mkjraler.exe
        
        C:\Windows\system32\mkjraler.exe
        8⤵
        
        PID:14776
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240649812.bat
        9⤵
        
        PID:9220
        
        C:\Windows\SysWOW64\mkjraler.exe
        
        C:\Windows\system32\mkjraler.exe
        9⤵
        
        PID:3064
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240650265.bat
        10⤵
        
        PID:13356
        
        C:\Windows\SysWOW64\mkjraler.exe
        
        C:\Windows\system32\mkjraler.exe
        10⤵
        
        PID:7000
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240650593.bat
        11⤵
        
        PID:15124
        
        C:\Windows\SysWOW64\mkjraler.exe
        
        C:\Windows\system32\mkjraler.exe
        11⤵
        
        PID:10692
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240650953.bat
        12⤵
        
        PID:17308
        
        C:\Windows\SysWOW64\mkjraler.exe
        
        C:\Windows\system32\mkjraler.exe
        12⤵
        
        PID:12352
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240651250.bat
        13⤵
        
        PID:18104
        
        C:\Windows\SysWOW64\mkjraler.exe
        
        C:\Windows\system32\mkjraler.exe
        13⤵
        
        PID:11488
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240651562.bat
        14⤵
        
        PID:17516
        
        C:\Windows\SysWOW64\mkjraler.exe
        
        C:\Windows\system32\mkjraler.exe
        14⤵
        
        PID:12588
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240651921.bat
        15⤵
        
        PID:9160
        
        C:\Windows\SysWOW64\mkjraler.exe
        
        C:\Windows\system32\mkjraler.exe
        15⤵
        
        PID:16492
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240652468.bat
        16⤵
        
        PID:14204
        
        C:\Windows\SysWOW64\mkjraler.exe
        
        C:\Windows\system32\mkjraler.exe
        16⤵
        
        PID:6764
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240652937.bat
        17⤵
        
        PID:16128
        
        C:\Windows\SysWOW64\mkjraler.exe
        
        C:\Windows\system32\mkjraler.exe
        17⤵
        
        PID:11636
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240653453.bat
        18⤵
        
        PID:16588
        
        C:\Windows\SysWOW64\mkjraler.exe
        
        C:\Windows\system32\mkjraler.exe
        18⤵
        
        PID:18332
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240653718.bat
        19⤵
        
        PID:5180

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240646906.bat
1⤵
PID:6392

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\~DFD240603281.bat

Filesize
121B

MD5
09517fc62284f33e877a276463580bd1

SHA1
0b14fe1db4493818f9de0bf2a56ee5370b8d479a

SHA256
6cc6bbb1f3f754b6894d84130f5f2d86569ac3a603e1632d3cefa028f22b6238

SHA512
1b924dd216d0f38199cc6df215e65ff260aa48fa37aa620dabcbc616f434643bd1f2e617d66b14bd52900214148741565128ba9589782ba582fd7308369f4a4d

Download Submit
C:\Users\Admin\AppData\Local\Temp\~DFD240634906.bat

Filesize
121B

MD5
39fcdea924b37762d63ac718396f7b84

SHA1
804548a2ea1ad147ce6f1236db72998b383861b2

SHA256
102c1b9c443043f2225350fce2abf0d22a9ff266549a9c21e17afd7004a1d21f

SHA512
b7ec77e639a2a89c345b0c087668cea9da69163c215006fed42874f7376285556fd18d61c4a8f22d08c49677ff6f8891e338a61449fe922bc893eefd8ec84f0b

Download Submit
C:\Windows\SysWOW64\arjrkler.dll

Filesize
523KB

MD5
32a86afb603028f5712c0373ab05d3ad

SHA1
addfedcb52278cf84d77ad1bf41eafd43a065774

SHA256
544addf429e909b64ba7118317039b2e5dbe134b4e22c1d795a8514172d5b47a

SHA512
185e7010005ddf257e5501fa82610790e4a04ae9bfd152080a93fcf1ce70c773abcd0cb3c0263665f49fa5d31784bc0242e08788f13461502af39a3a923d2a35

Download Submit
C:\Windows\SysWOW64\arjrkler.dll

Filesize
103KB

MD5
dff61a03c4374289f4fc7451c46a37cc

SHA1
e98c6063317f03b8e86960bffda74ca57a3e1f06

SHA256
c363712be51621d970899dd8706f99bb4446df2ec857e8b78f6bd0c0498911b7

SHA512
d981d190ad128ec8ba917352ca4e9e5ddd4190e27e9f65e9949bff2fb02251e5e7b1aae53514aeaf60b412ba376426ba328b694cc0cf1437a3e1089e4ba83b58

Download Submit
C:\Windows\SysWOW64\arjrkler.dll

Filesize
523KB

MD5
656ae14d2895859b079f1789ca2c8711

SHA1
4facab969c76cc9747da2319925ab4debf2aabbf

SHA256
9b129e02729738317e18f4a45a6ce6ff5b5c931a5088d49def6e5aa62cad18e9

SHA512
1827ba6712b9b3c958866c7be25e5e7408ba15b94252b25ba7dd81e8229bbed4974c3ad91d134e28fd38c317007d7e35b73c774f6a91b9d073c1560c29e8f51b

Download Submit
C:\Windows\SysWOW64\arjrkler.dll

Filesize
512KB

MD5
d90955047d3823d8dc7a3e5c9421a1a7

SHA1
a0d7119bfdb2aafee67a298f96b0670e48eaa693

SHA256
bd33ec5a249edbec5bd94058d5c973de1960bcca105fa8ec3831c975116314e3

SHA512
a7db516cae17b730d34bbf80c09eaedccff49e2c318de183327ec19c48b51bbef261a22f94d9f9c23cce16987607f181d46471a3b15f27a4579880d8967c3e31

Download Submit
C:\Windows\SysWOW64\iujraler.sys

Filesize
520B

MD5
0af6c05318348d1cbbd0adaf8a06aa69

SHA1
f5a2db0a84d2a3da29e00f38e8d7b9718bfc7b80

SHA256
d2f506acfeb212c17eac45debb16f63b49145cb1d5e5adc04c2e5b8a8ab5ba51

SHA512
e704156506384103731206a4f3998b4a5fdbd1abadd65b8226954c8922adae4f7247bec3ade4126279a01df015d154dcfab6fe79a3499a43d1713e7293173e71

Download Submit
C:\Windows\SysWOW64\mkjraler.exe

Filesize
17KB

MD5
7b65f3b2f451ca36d1f2ae8f797b7ca5

SHA1
76e5a8a0ec9059aa4bfb3217b3cb2683ad3cd364

SHA256
f277c264e31b5a55b2fb33e6bd32964b455b7d47da22907fc04e13d2c5d1d0e0

SHA512
546a00abadc7f7f88705552ff3e0d3ae27c54f366fb5521d7a502ac5e363ca233701f48e81ede8f9eadbbb224a5a105801f40e357389e23b768983c2ceb9ee0d

Download Submit
memory/972-44246-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/1288-53982-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/2072-49650-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/2124-50804-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/2684-62236-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/3588-12171-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/3640-43012-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/3792-17137-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/4320-12173-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/4320-0-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/4348-7379-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/4420-27517-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/4468-17356-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/4544-20291-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/4808-30560-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/5244-32183-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/5360-39558-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/5396-41536-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/5440-19043-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/5580-60537-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/5592-21431-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/5612-13189-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/5612-1023-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/5648-10402-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/5688-19278-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/5728-60986-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/6040-58366-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/6876-58905-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/6928-13706-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/7160-37211-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/7260-26132-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/7532-9361-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/7592-4884-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/7836-15978-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/7896-17139-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/8024-29395-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/8056-49497-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/8132-5388-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/8148-22381-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/8208-23865-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/8260-33075-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/8600-36470-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/8864-34970-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/8936-8122-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/9256-48601-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/9256-38492-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/9980-34447-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/10396-4885-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/10472-50624-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/10644-35559-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/10692-24341-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/10756-28543-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/10816-55682-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/10904-55679-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/10944-13093-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/11040-6091-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/11172-14825-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/11332-44883-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/11572-56693-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/11732-54802-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/11884-52517-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/12152-47447-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/12216-48392-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/12236-48062-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download