08eda86a5fc8ecf563d1f42dc84d4aac0a356ae2068febd87d66454639a8cbd0

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
19/07/2024, 18:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5d16231a4f293b24456e7efd6136ddf9_JaffaCakes118.exe
Size

382KB
MD5

5d16231a4f293b24456e7efd6136ddf9
SHA1

8665c5f56fb7beaa90e6d7d655abc7550b4013a3
SHA256

08eda86a5fc8ecf563d1f42dc84d4aac0a356ae2068febd87d66454639a8cbd0
SHA512

eb261043a2d3420aae8d83af0a1a84047429b092207a3f28de613b1fc8d46278bee45a917eb99aef4b39bd56a633538dd8c92c3026aed0e349ebf4d3318ec3be
SSDEEP

6144:KePaoj6mzxv0qAqfbyxDkN7YYbAeAbkZwTagAq3l0+wmDGgC:Ke5j7zN0qAqGxGdoQZwTaFOGH

Score

10^/10

evasion

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	tazebama.dl_

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	tazebama.dl_

Executes dropped EXE 64 IoCs

pid	Process
2152	tazebama.dl_
2052	tazebama.dl_
584	tazebama.dl_
2124	tazebama.dl_
1864	tazebama.dl_
2804	tazebama.dl_
2800	tazebama.dl_
2768	tazebama.dl_
2676	tazebama.dl_
2584	tazebama.dl_
2732	tazebama.dl_
2632	tazebama.dl_
1448	tazebama.dl_
1972	tazebama.dl_
2560	tazebama.dl_
352	tazebama.dl_
1072	tazebama.dl_
1620	tazebama.dl_
2168	tazebama.dl_
2212	tazebama.dl_
3048	tazebama.dl_
1936	tazebama.dl_
884	tazebama.dl_
1068	tazebama.dl_
328	tazebama.dl_
1204	tazebama.dl_
3000	tazebama.dl_
1624	tazebama.dl_
2236	tazebama.dl_
856	tazebama.dl_
2972	tazebama.dl_
572	tazebama.dl_
2980	tazebama.dl_
896	tazebama.dl_
2096	tazebama.dl_
2224	tazebama.dl_
644	tazebama.dl_
2920	tazebama.dl_
2112	tazebama.dl_
1320	tazebama.dl_
3028	tazebama.dl_
2964	tazebama.dl_
3084	tazebama.dl_
3140	tazebama.dl_
3200	tazebama.dl_
3268	tazebama.dl_
3316	tazebama.dl_
3384	tazebama.dl_
3444	tazebama.dl_
3492	tazebama.dl_
3544	tazebama.dl_
3616	tazebama.dl_
3664	tazebama.dl_
3728	tazebama.dl_
1712	tazebama.dl_
1536	tazebama.dl_
1372	tazebama.dl_
616	tazebama.dl_
1496	tazebama.dl_
1452	tazebama.dl_
1976	tazebama.dl_
2696	tazebama.dl_
2272	tazebama.dl_
2868	tazebama.dl_

Loads dropped DLL 64 IoCs

pid	Process
2488	5d16231a4f293b24456e7efd6136ddf9_JaffaCakes118.exe
2488	5d16231a4f293b24456e7efd6136ddf9_JaffaCakes118.exe
2488	5d16231a4f293b24456e7efd6136ddf9_JaffaCakes118.exe
2488	5d16231a4f293b24456e7efd6136ddf9_JaffaCakes118.exe
2488	5d16231a4f293b24456e7efd6136ddf9_JaffaCakes118.exe
2488	5d16231a4f293b24456e7efd6136ddf9_JaffaCakes118.exe
2488	5d16231a4f293b24456e7efd6136ddf9_JaffaCakes118.exe
2488	5d16231a4f293b24456e7efd6136ddf9_JaffaCakes118.exe
2488	5d16231a4f293b24456e7efd6136ddf9_JaffaCakes118.exe
2488	5d16231a4f293b24456e7efd6136ddf9_JaffaCakes118.exe
2488	5d16231a4f293b24456e7efd6136ddf9_JaffaCakes118.exe
2488	5d16231a4f293b24456e7efd6136ddf9_JaffaCakes118.exe
2488	5d16231a4f293b24456e7efd6136ddf9_JaffaCakes118.exe
2488	5d16231a4f293b24456e7efd6136ddf9_JaffaCakes118.exe
2488	5d16231a4f293b24456e7efd6136ddf9_JaffaCakes118.exe
2488	5d16231a4f293b24456e7efd6136ddf9_JaffaCakes118.exe
2488	5d16231a4f293b24456e7efd6136ddf9_JaffaCakes118.exe
2488	5d16231a4f293b24456e7efd6136ddf9_JaffaCakes118.exe
2488	5d16231a4f293b24456e7efd6136ddf9_JaffaCakes118.exe
2488	5d16231a4f293b24456e7efd6136ddf9_JaffaCakes118.exe
2488	5d16231a4f293b24456e7efd6136ddf9_JaffaCakes118.exe
2488	5d16231a4f293b24456e7efd6136ddf9_JaffaCakes118.exe
2488	5d16231a4f293b24456e7efd6136ddf9_JaffaCakes118.exe
2488	5d16231a4f293b24456e7efd6136ddf9_JaffaCakes118.exe
2488	5d16231a4f293b24456e7efd6136ddf9_JaffaCakes118.exe
2488	5d16231a4f293b24456e7efd6136ddf9_JaffaCakes118.exe
2488	5d16231a4f293b24456e7efd6136ddf9_JaffaCakes118.exe
2488	5d16231a4f293b24456e7efd6136ddf9_JaffaCakes118.exe
2488	5d16231a4f293b24456e7efd6136ddf9_JaffaCakes118.exe
2488	5d16231a4f293b24456e7efd6136ddf9_JaffaCakes118.exe
2488	5d16231a4f293b24456e7efd6136ddf9_JaffaCakes118.exe
2488	5d16231a4f293b24456e7efd6136ddf9_JaffaCakes118.exe
2488	5d16231a4f293b24456e7efd6136ddf9_JaffaCakes118.exe
2488	5d16231a4f293b24456e7efd6136ddf9_JaffaCakes118.exe
2488	5d16231a4f293b24456e7efd6136ddf9_JaffaCakes118.exe
2488	5d16231a4f293b24456e7efd6136ddf9_JaffaCakes118.exe
2488	5d16231a4f293b24456e7efd6136ddf9_JaffaCakes118.exe
2488	5d16231a4f293b24456e7efd6136ddf9_JaffaCakes118.exe
2488	5d16231a4f293b24456e7efd6136ddf9_JaffaCakes118.exe
2488	5d16231a4f293b24456e7efd6136ddf9_JaffaCakes118.exe
2488	5d16231a4f293b24456e7efd6136ddf9_JaffaCakes118.exe
2488	5d16231a4f293b24456e7efd6136ddf9_JaffaCakes118.exe
2488	5d16231a4f293b24456e7efd6136ddf9_JaffaCakes118.exe
2488	5d16231a4f293b24456e7efd6136ddf9_JaffaCakes118.exe
2488	5d16231a4f293b24456e7efd6136ddf9_JaffaCakes118.exe
2488	5d16231a4f293b24456e7efd6136ddf9_JaffaCakes118.exe
2488	5d16231a4f293b24456e7efd6136ddf9_JaffaCakes118.exe
2488	5d16231a4f293b24456e7efd6136ddf9_JaffaCakes118.exe
2488	5d16231a4f293b24456e7efd6136ddf9_JaffaCakes118.exe
2488	5d16231a4f293b24456e7efd6136ddf9_JaffaCakes118.exe
2488	5d16231a4f293b24456e7efd6136ddf9_JaffaCakes118.exe
2488	5d16231a4f293b24456e7efd6136ddf9_JaffaCakes118.exe
2488	5d16231a4f293b24456e7efd6136ddf9_JaffaCakes118.exe
2488	5d16231a4f293b24456e7efd6136ddf9_JaffaCakes118.exe
2488	5d16231a4f293b24456e7efd6136ddf9_JaffaCakes118.exe
2488	5d16231a4f293b24456e7efd6136ddf9_JaffaCakes118.exe
2488	5d16231a4f293b24456e7efd6136ddf9_JaffaCakes118.exe
2488	5d16231a4f293b24456e7efd6136ddf9_JaffaCakes118.exe
2488	5d16231a4f293b24456e7efd6136ddf9_JaffaCakes118.exe
2488	5d16231a4f293b24456e7efd6136ddf9_JaffaCakes118.exe
2488	5d16231a4f293b24456e7efd6136ddf9_JaffaCakes118.exe
2488	5d16231a4f293b24456e7efd6136ddf9_JaffaCakes118.exe
2488	5d16231a4f293b24456e7efd6136ddf9_JaffaCakes118.exe
2488	5d16231a4f293b24456e7efd6136ddf9_JaffaCakes118.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	tazebama.dl_
File opened (read-only)	\??\S:	tazebama.dl_
File opened (read-only)	\??\Q:	tazebama.dl_
File opened (read-only)	\??\O:	tazebama.dl_
File opened (read-only)	\??\J:	tazebama.dl_
File opened (read-only)	\??\I:	tazebama.dl_
File opened (read-only)	\??\E:	tazebama.dl_
File opened (read-only)	\??\W:	tazebama.dl_
File opened (read-only)	\??\V:	tazebama.dl_
File opened (read-only)	\??\N:	tazebama.dl_
File opened (read-only)	\??\L:	tazebama.dl_
File opened (read-only)	\??\K:	tazebama.dl_
File opened (read-only)	\??\H:	tazebama.dl_
File opened (read-only)	\??\U:	tazebama.dl_
File opened (read-only)	\??\T:	tazebama.dl_
File opened (read-only)	\??\P:	tazebama.dl_
File opened (read-only)	\??\M:	tazebama.dl_
File opened (read-only)	\??\Y:	tazebama.dl_
File opened (read-only)	\??\X:	tazebama.dl_
File opened (read-only)	\??\R:	tazebama.dl_
File opened (read-only)	\??\G:	tazebama.dl_

Drops autorun.inf file 1 TTPs 3 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	F:\autorun.inf	tazebama.dl_
File opened for modification	C:\autorun.inf	tazebama.dl_
File opened for modification	C:\Documents and Settings\Admin\Local Settings\Application Data\Microsoft\CD Burning\autorun.inf	tazebama.dl_

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File opened for modification	C:\PROGRA~2\MICROS~1\OFFICE14\INFOPATH.EXE	tazebama.dl_
File opened for modification	C:\PROGRA~2\MICROS~1\OFFICE14\MSACCESS.EXE	tazebama.dl_
File opened for modification	C:\PROGRA~2\MICROS~1\OFFICE14\MSPUB.EXE	tazebama.dl_
File opened for modification	C:\PROGRA~2\MICROS~1\OFFICE14\OIS.EXE	tazebama.dl_
File opened for modification	C:\PROGRA~2\MICROS~1\OFFICE14\ONENOTE.EXE	tazebama.dl_
File opened for modification	C:\PROGRA~2\MICROS~1\OFFICE14\OUTLOOK.EXE	tazebama.dl_
File opened for modification	C:\PROGRA~2\MICROS~1\OFFICE14\EXCEL.EXE	tazebama.dl_
File opened for modification	C:\PROGRA~2\MICROS~1\OFFICE14\GROOVE.EXE	tazebama.dl_

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4924	4564	WerFault.exe	226

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2152	tazebama.dl_
2052	tazebama.dl_
584	tazebama.dl_
2124	tazebama.dl_
1864	tazebama.dl_
2804	tazebama.dl_
2800	tazebama.dl_
2768	tazebama.dl_
2676	tazebama.dl_
2584	tazebama.dl_
2632	tazebama.dl_
2732	tazebama.dl_
1448	tazebama.dl_
1972	tazebama.dl_
2560	tazebama.dl_
352	tazebama.dl_
1620	tazebama.dl_
2168	tazebama.dl_
2168	tazebama.dl_
1072	tazebama.dl_
1072	tazebama.dl_
2212	tazebama.dl_
2212	tazebama.dl_
3048	tazebama.dl_
3048	tazebama.dl_
3048	tazebama.dl_
3048	tazebama.dl_
1936	tazebama.dl_
1936	tazebama.dl_
1936	tazebama.dl_
1936	tazebama.dl_
884	tazebama.dl_
884	tazebama.dl_
884	tazebama.dl_
2096	tazebama.dl_
2096	tazebama.dl_
2096	tazebama.dl_
3444	tazebama.dl_
3444	tazebama.dl_
3444	tazebama.dl_
3492	tazebama.dl_
3492	tazebama.dl_
3492	tazebama.dl_
3384	tazebama.dl_
3384	tazebama.dl_
3384	tazebama.dl_
644	tazebama.dl_
644	tazebama.dl_
644	tazebama.dl_
2224	tazebama.dl_
2224	tazebama.dl_
2224	tazebama.dl_
2920	tazebama.dl_
2920	tazebama.dl_
2920	tazebama.dl_
2112	tazebama.dl_
2112	tazebama.dl_
2112	tazebama.dl_
1320	tazebama.dl_
1320	tazebama.dl_
1320	tazebama.dl_
3084	tazebama.dl_
3084	tazebama.dl_
3084	tazebama.dl_

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2488 wrote to memory of 2152	2488	5d16231a4f293b24456e7efd6136ddf9_JaffaCakes118.exe	31
PID 2488 wrote to memory of 2152	2488	5d16231a4f293b24456e7efd6136ddf9_JaffaCakes118.exe	31
PID 2488 wrote to memory of 2152	2488	5d16231a4f293b24456e7efd6136ddf9_JaffaCakes118.exe	31
PID 2488 wrote to memory of 2152	2488	5d16231a4f293b24456e7efd6136ddf9_JaffaCakes118.exe	31
PID 2488 wrote to memory of 2124	2488	5d16231a4f293b24456e7efd6136ddf9_JaffaCakes118.exe	32
PID 2488 wrote to memory of 2124	2488	5d16231a4f293b24456e7efd6136ddf9_JaffaCakes118.exe	32
PID 2488 wrote to memory of 2124	2488	5d16231a4f293b24456e7efd6136ddf9_JaffaCakes118.exe	32
PID 2488 wrote to memory of 2124	2488	5d16231a4f293b24456e7efd6136ddf9_JaffaCakes118.exe	32
PID 2488 wrote to memory of 2052	2488	5d16231a4f293b24456e7efd6136ddf9_JaffaCakes118.exe	33
PID 2488 wrote to memory of 2052	2488	5d16231a4f293b24456e7efd6136ddf9_JaffaCakes118.exe	33
PID 2488 wrote to memory of 2052	2488	5d16231a4f293b24456e7efd6136ddf9_JaffaCakes118.exe	33
PID 2488 wrote to memory of 2052	2488	5d16231a4f293b24456e7efd6136ddf9_JaffaCakes118.exe	33
PID 2488 wrote to memory of 1864	2488	5d16231a4f293b24456e7efd6136ddf9_JaffaCakes118.exe	34
PID 2488 wrote to memory of 1864	2488	5d16231a4f293b24456e7efd6136ddf9_JaffaCakes118.exe	34
PID 2488 wrote to memory of 1864	2488	5d16231a4f293b24456e7efd6136ddf9_JaffaCakes118.exe	34
PID 2488 wrote to memory of 1864	2488	5d16231a4f293b24456e7efd6136ddf9_JaffaCakes118.exe	34
PID 2488 wrote to memory of 584	2488	5d16231a4f293b24456e7efd6136ddf9_JaffaCakes118.exe	35
PID 2488 wrote to memory of 584	2488	5d16231a4f293b24456e7efd6136ddf9_JaffaCakes118.exe	35
PID 2488 wrote to memory of 584	2488	5d16231a4f293b24456e7efd6136ddf9_JaffaCakes118.exe	35
PID 2488 wrote to memory of 584	2488	5d16231a4f293b24456e7efd6136ddf9_JaffaCakes118.exe	35
PID 2488 wrote to memory of 2804	2488	5d16231a4f293b24456e7efd6136ddf9_JaffaCakes118.exe	36
PID 2488 wrote to memory of 2804	2488	5d16231a4f293b24456e7efd6136ddf9_JaffaCakes118.exe	36
PID 2488 wrote to memory of 2804	2488	5d16231a4f293b24456e7efd6136ddf9_JaffaCakes118.exe	36
PID 2488 wrote to memory of 2804	2488	5d16231a4f293b24456e7efd6136ddf9_JaffaCakes118.exe	36
PID 2488 wrote to memory of 2800	2488	5d16231a4f293b24456e7efd6136ddf9_JaffaCakes118.exe	37
PID 2488 wrote to memory of 2800	2488	5d16231a4f293b24456e7efd6136ddf9_JaffaCakes118.exe	37
PID 2488 wrote to memory of 2800	2488	5d16231a4f293b24456e7efd6136ddf9_JaffaCakes118.exe	37
PID 2488 wrote to memory of 2800	2488	5d16231a4f293b24456e7efd6136ddf9_JaffaCakes118.exe	37
PID 2488 wrote to memory of 2768	2488	5d16231a4f293b24456e7efd6136ddf9_JaffaCakes118.exe	38
PID 2488 wrote to memory of 2768	2488	5d16231a4f293b24456e7efd6136ddf9_JaffaCakes118.exe	38
PID 2488 wrote to memory of 2768	2488	5d16231a4f293b24456e7efd6136ddf9_JaffaCakes118.exe	38
PID 2488 wrote to memory of 2768	2488	5d16231a4f293b24456e7efd6136ddf9_JaffaCakes118.exe	38
PID 2488 wrote to memory of 2676	2488	5d16231a4f293b24456e7efd6136ddf9_JaffaCakes118.exe	39
PID 2488 wrote to memory of 2676	2488	5d16231a4f293b24456e7efd6136ddf9_JaffaCakes118.exe	39
PID 2488 wrote to memory of 2676	2488	5d16231a4f293b24456e7efd6136ddf9_JaffaCakes118.exe	39
PID 2488 wrote to memory of 2676	2488	5d16231a4f293b24456e7efd6136ddf9_JaffaCakes118.exe	39
PID 2488 wrote to memory of 2584	2488	5d16231a4f293b24456e7efd6136ddf9_JaffaCakes118.exe	40
PID 2488 wrote to memory of 2584	2488	5d16231a4f293b24456e7efd6136ddf9_JaffaCakes118.exe	40
PID 2488 wrote to memory of 2584	2488	5d16231a4f293b24456e7efd6136ddf9_JaffaCakes118.exe	40
PID 2488 wrote to memory of 2584	2488	5d16231a4f293b24456e7efd6136ddf9_JaffaCakes118.exe	40
PID 2488 wrote to memory of 2732	2488	5d16231a4f293b24456e7efd6136ddf9_JaffaCakes118.exe	41
PID 2488 wrote to memory of 2732	2488	5d16231a4f293b24456e7efd6136ddf9_JaffaCakes118.exe	41
PID 2488 wrote to memory of 2732	2488	5d16231a4f293b24456e7efd6136ddf9_JaffaCakes118.exe	41
PID 2488 wrote to memory of 2732	2488	5d16231a4f293b24456e7efd6136ddf9_JaffaCakes118.exe	41
PID 2488 wrote to memory of 2560	2488	5d16231a4f293b24456e7efd6136ddf9_JaffaCakes118.exe	42
PID 2488 wrote to memory of 2560	2488	5d16231a4f293b24456e7efd6136ddf9_JaffaCakes118.exe	42
PID 2488 wrote to memory of 2560	2488	5d16231a4f293b24456e7efd6136ddf9_JaffaCakes118.exe	42
PID 2488 wrote to memory of 2560	2488	5d16231a4f293b24456e7efd6136ddf9_JaffaCakes118.exe	42
PID 2488 wrote to memory of 2632	2488	5d16231a4f293b24456e7efd6136ddf9_JaffaCakes118.exe	43
PID 2488 wrote to memory of 2632	2488	5d16231a4f293b24456e7efd6136ddf9_JaffaCakes118.exe	43
PID 2488 wrote to memory of 2632	2488	5d16231a4f293b24456e7efd6136ddf9_JaffaCakes118.exe	43
PID 2488 wrote to memory of 2632	2488	5d16231a4f293b24456e7efd6136ddf9_JaffaCakes118.exe	43
PID 2488 wrote to memory of 2212	2488	5d16231a4f293b24456e7efd6136ddf9_JaffaCakes118.exe	44
PID 2488 wrote to memory of 2212	2488	5d16231a4f293b24456e7efd6136ddf9_JaffaCakes118.exe	44
PID 2488 wrote to memory of 2212	2488	5d16231a4f293b24456e7efd6136ddf9_JaffaCakes118.exe	44
PID 2488 wrote to memory of 2212	2488	5d16231a4f293b24456e7efd6136ddf9_JaffaCakes118.exe	44
PID 2488 wrote to memory of 1448	2488	5d16231a4f293b24456e7efd6136ddf9_JaffaCakes118.exe	45
PID 2488 wrote to memory of 1448	2488	5d16231a4f293b24456e7efd6136ddf9_JaffaCakes118.exe	45
PID 2488 wrote to memory of 1448	2488	5d16231a4f293b24456e7efd6136ddf9_JaffaCakes118.exe	45
PID 2488 wrote to memory of 1448	2488	5d16231a4f293b24456e7efd6136ddf9_JaffaCakes118.exe	45
PID 2488 wrote to memory of 1936	2488	5d16231a4f293b24456e7efd6136ddf9_JaffaCakes118.exe	46
PID 2488 wrote to memory of 1936	2488	5d16231a4f293b24456e7efd6136ddf9_JaffaCakes118.exe	46
PID 2488 wrote to memory of 1936	2488	5d16231a4f293b24456e7efd6136ddf9_JaffaCakes118.exe	46
PID 2488 wrote to memory of 1936	2488	5d16231a4f293b24456e7efd6136ddf9_JaffaCakes118.exe	46

C:\Users\Admin\AppData\Local\Temp\5d16231a4f293b24456e7efd6136ddf9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5d16231a4f293b24456e7efd6136ddf9_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2488
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2152
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2124
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2052
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:1864
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:584
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2804
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2800
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2768
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2676
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2584
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2732
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2560
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2632
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2212
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:1448
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:1936
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:1972
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  PID:1068
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:352
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  PID:328
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:1072
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  PID:1204
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:1620
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  PID:3000
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2168
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:3048
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  PID:2236
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:884
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  PID:1712
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  PID:856
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  PID:1536
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  PID:1372
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  PID:572
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  PID:616
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  PID:2980
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  PID:1496
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  PID:896
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  PID:1452
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2096
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  PID:1976
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2224
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:644
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  PID:2272
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2920
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  PID:2868
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2112
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2364
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:1320
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2656
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  PID:3028
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:1532
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  PID:2964
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2316
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:3084
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3108
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  PID:3140
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3164
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  PID:3200
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3224
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  PID:3268
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3292
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  PID:3316
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3340
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:3384
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3408
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:3444
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3468
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:3492
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3516
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  PID:3544
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3584
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  PID:3616
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3640
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  PID:3664
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3692
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  PID:3728
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3756
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3828
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3852
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3876
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3900
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3928
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3972
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3996
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4024
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4052
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4080
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2252
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:1888
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2856
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3060
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2100
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:484
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:264
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3284
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3396
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3404
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:1080
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:920
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3460
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:1700
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3624
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3680
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2580
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:1664
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2832
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3736
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3836
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3884
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3944
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4020
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2908
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:1184
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:1640
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:848
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:1596
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2500
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3008
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:448
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3652
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3780
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2240
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2412
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2776
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2636
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2556
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:1020
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2044
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3132
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3252
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3372
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3436
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3704
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3952
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4064
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4032
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2408
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2184
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3860
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2772
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:1960
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2604
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:1916
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2400
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3120
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:1764
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3232
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:1032
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3352
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3348
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2216
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3508
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:1312
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3724
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3424
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:1580
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2444
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3960
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:1520
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2564
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:1348
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3476
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3672
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2608
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3532
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2032
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3128
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2996
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3632
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:1232
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2820
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2660
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:992
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:1692
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3764
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:1680
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3804
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:1248
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4092
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3988
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3612
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3076
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2588
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3592
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3796
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3872
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3380
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2320
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2292
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2960
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4108
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4132
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Enumerates connected drives
  - Drops autorun.inf file
  - Drops file in Program Files directory
  PID:4564
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4564 -s 320
    3⤵
    - Program crash
    PID:4924
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4776
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4936
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4952
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4964
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4976
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:5000
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:5012
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:5024
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:5036
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:5048
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:5060
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:5072
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:5084
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:5096
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:5108
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3812
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:1516
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3096
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:1492
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:1524
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2432
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:964
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3660
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3432
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3240
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:348
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3364
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:1808
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2396
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2900
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3700
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3036
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:1872
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4204
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4244
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4256
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4268
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:340
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:904
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4076
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2140
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:636
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3300
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3864
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2384
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4004
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3188
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4324
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4336
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4360
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3916
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2884
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3600
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:1016
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3772
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2368
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3844
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2164
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:1508
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3968
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3368
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:1140
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3040
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2736
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3304
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3748
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2616
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:1744
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3236
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2520
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3820
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4372
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4388
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4404
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4420
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4444
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4460
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4476
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4496
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4512
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4532
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4552
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4576
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4592
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4608
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4624
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4636
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4652
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4672
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4688
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4708
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4724
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4744
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4760
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4768
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4792
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4820
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4816
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4844
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4860
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4884
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4900
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4916
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4932
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4988
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:5020
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:5092
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3260
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:5056
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3180
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3456
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3572
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3024
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:1956
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:916
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:1612
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4144
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3676
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3788
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4168
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4180
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4192
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4212
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4224
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4252
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:1568
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4100
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2196
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4284
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2484
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:852
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2796
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4308
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4120
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4116
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:1604
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:5128
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:5144
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:5160
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:5176
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:5196
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:5212
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:5228
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:5244
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:5264
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:5280
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:5292
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:5308
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:5324
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:5340
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:5356
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:5376
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:5396
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:5416
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:5432
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:5448
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:5460
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:5472
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:5492
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:5504
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:5524
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:5536
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:5556
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:5568
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:5580
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:5596
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:5608
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:5624
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:5640
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:5656
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:5672
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:5684
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:5704
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:5720
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:5740
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:5752
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:5772
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:5784
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:5800
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:5812
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:5824
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:5844
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:5860
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:5872
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:5884
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:5904
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:5924
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:5944
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:5956
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:5976
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:5996
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:6012
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:6032
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:6044
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:6060
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:6076
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:6092
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:6112

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\autorun.inf

Filesize
126B

MD5
163e20cbccefcdd42f46e43a94173c46

SHA1
4c7b5048e8608e2a75799e00ecf1bbb4773279ae

SHA256
7780bee9df142a17e0457f3dcb2788b50fc2792370089335597d33719126fb7e

SHA512
e5ac0ff6b087857799ab70f68067c9dc73eeb93ccfcad87047052380b95ade3e6eb2a7d01a0f850d548a39f4b1ebb60e299d603dbe25c31b9a3585b34a0c65a8

Download Submit
C:\zPharaoh.exe

Filesize
157KB

MD5
164a6ffa3ba57d3449b8318c23c05a49

SHA1
fc3d730b32d56a489f76936b4eba294d0a1f70b3

SHA256
f1a23c6ce095f93e4896823d090a69c069bdc06c4bdaec3d1c13dbc21db1d0d7

SHA512
5546aa9ced4d8347c0731102168e3049b0bdc3315e7f19b7831cbc93c22f61547d6df621a8e924094c2a152ef49ec5c54e674b0e09293fb3135de0d2a132a25e

Download Submit
F:\zPharaoh.exe

Filesize
157KB

MD5
b3af5b2716be4f595206f65e53300c45

SHA1
1a064bf9ab1153aad122f013682433c97e355d1d

SHA256
f41c1be8934fba0292e9bceb69ac489e36ca38a8954d13c496c47bfacc955dc8

SHA512
ae60c98bce471aa954cad8f6f9e26fb9010070489fc482211c7b30b12883c50c5a320ae92179cbece6cd28e9de5c530271ae54b700b1c629692884a8383b8451

Download Submit
\Users\tazebama.dl_

Filesize
157KB

MD5
7ad28b3622198870b43e50fc9893e5b0

SHA1
a3ab1fd83de96c2ebf1138c974ea1736dd04d1fe

SHA256
21455555e3654c57c0fddd872945cba78920dd59bdc1b5845679258e05ef065a

SHA512
a029af858d33f22ad1fe00c95fdbc61c5398ebeacce4f3336bd01e34f50218e2a42d36e01abaf5b94c7278ae1e4965185b84b59ccbfa74f59e9bbab08cece5dd

Download Submit
\Users\tazebama.dll

Filesize
32KB

MD5
b6a03576e595afacb37ada2f1d5a0529

SHA1
d598d4d0e70dec2ffa2849edaeb4db94fedcc0b8

SHA256
1707eaf60aa91f3791aa5643bfa038e9d8141878d61f5d701ebac51f4ae7aaad

SHA512
181b7cc6479352fe2c53c3630d45a839cdeb74708be6709c2a75847a54de3ffc1fdac8450270dde7174ecb23e5cb002f8ce39032429a3112b1202f3381b8918c

Download Submit
memory/352-201-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/572-248-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/584-133-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/856-230-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/1068-208-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/1620-203-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/1864-194-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/1936-206-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2052-145-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2096-278-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2124-193-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2152-106-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2168-204-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2212-205-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2236-210-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2488-467-0x0000000000290000-0x00000000002A8000-memory.dmp

Filesize
96KB

Download
memory/2488-379-0x0000000000290000-0x00000000002A8000-memory.dmp

Filesize
96KB

Download
memory/2488-0-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2488-365-0x0000000000290000-0x00000000002A8000-memory.dmp

Filesize
96KB

Download
memory/2488-80-0x0000000000290000-0x00000000002A8000-memory.dmp

Filesize
96KB

Download
memory/2488-442-0x0000000000290000-0x00000000002A8000-memory.dmp

Filesize
96KB

Download
memory/2488-461-0x0000000000290000-0x00000000002A8000-memory.dmp

Filesize
96KB

Download
memory/2488-433-0x0000000000290000-0x00000000002A8000-memory.dmp

Filesize
96KB

Download
memory/2488-81-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2488-468-0x0000000000290000-0x00000000002A8000-memory.dmp

Filesize
96KB

Download
memory/2488-434-0x0000000000290000-0x00000000002A8000-memory.dmp

Filesize
96KB

Download
memory/2488-435-0x0000000000290000-0x00000000002A8000-memory.dmp

Filesize
96KB

Download
memory/2488-207-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2488-459-0x0000000000290000-0x00000000002A8000-memory.dmp

Filesize
96KB

Download
memory/2488-153-0x0000000000290000-0x00000000002A8000-memory.dmp

Filesize
96KB

Download
memory/2488-322-0x0000000000290000-0x00000000002A8000-memory.dmp

Filesize
96KB

Download
memory/2488-289-0x0000000000290000-0x00000000002A8000-memory.dmp

Filesize
96KB

Download
memory/2488-312-0x0000000000290000-0x00000000002A8000-memory.dmp

Filesize
96KB

Download
memory/2488-262-0x0000000000290000-0x00000000002A8000-memory.dmp

Filesize
96KB

Download
memory/2488-508-0x0000000000290000-0x00000000002A8000-memory.dmp

Filesize
96KB

Download
memory/2488-507-0x0000000000290000-0x00000000002A8000-memory.dmp

Filesize
96KB

Download
memory/2488-288-0x0000000000290000-0x00000000002A8000-memory.dmp

Filesize
96KB

Download
memory/2488-263-0x0000000000290000-0x00000000002A8000-memory.dmp

Filesize
96KB

Download
memory/2488-264-0x0000000000290000-0x00000000002A8000-memory.dmp

Filesize
96KB

Download
memory/2488-227-0x0000000000290000-0x00000000002A8000-memory.dmp

Filesize
96KB

Download
memory/2488-265-0x0000000000290000-0x00000000002A8000-memory.dmp

Filesize
96KB

Download
memory/2488-147-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2488-229-0x0000000000290000-0x00000000002A8000-memory.dmp

Filesize
96KB

Download
memory/2488-228-0x0000000000290000-0x00000000002A8000-memory.dmp

Filesize
96KB

Download
memory/2488-290-0x0000000000290000-0x00000000002A8000-memory.dmp

Filesize
96KB

Download
memory/2488-303-0x0000000000290000-0x00000000002A8000-memory.dmp

Filesize
96KB

Download
memory/2488-157-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2488-465-0x0000000000290000-0x00000000002A8000-memory.dmp

Filesize
96KB

Download
memory/2488-304-0x0000000000290000-0x00000000002A8000-memory.dmp

Filesize
96KB

Download
memory/2488-411-0x0000000000290000-0x00000000002A8000-memory.dmp

Filesize
96KB

Download
memory/2488-410-0x0000000000290000-0x00000000002A8000-memory.dmp

Filesize
96KB

Download
memory/2488-305-0x0000000000290000-0x00000000002A8000-memory.dmp

Filesize
96KB

Download
memory/2488-400-0x0000000000290000-0x00000000002A8000-memory.dmp

Filesize
96KB

Download
memory/2488-399-0x0000000000290000-0x00000000002A8000-memory.dmp

Filesize
96KB

Download
memory/2488-398-0x0000000000290000-0x00000000002A8000-memory.dmp

Filesize
96KB

Download
memory/2488-397-0x0000000000290000-0x00000000002A8000-memory.dmp

Filesize
96KB

Download
memory/2488-306-0x0000000000290000-0x00000000002A8000-memory.dmp

Filesize
96KB

Download
memory/2488-344-0x0000000000290000-0x00000000002A8000-memory.dmp

Filesize
96KB

Download
memory/2488-378-0x0000000000290000-0x00000000002A8000-memory.dmp

Filesize
96KB

Download
memory/2488-377-0x0000000000290000-0x00000000002A8000-memory.dmp

Filesize
96KB

Download
memory/2488-376-0x0000000000290000-0x00000000002A8000-memory.dmp

Filesize
96KB

Download
memory/2488-367-0x0000000000290000-0x00000000002A8000-memory.dmp

Filesize
96KB

Download
memory/2488-366-0x0000000000290000-0x00000000002A8000-memory.dmp

Filesize
96KB

Download
memory/2488-473-0x0000000000290000-0x00000000002A8000-memory.dmp

Filesize
96KB

Download
memory/2488-355-0x0000000000290000-0x00000000002A8000-memory.dmp

Filesize
96KB

Download
memory/2488-346-0x0000000000290000-0x00000000002A8000-memory.dmp

Filesize
96KB

Download
memory/2488-345-0x0000000000290000-0x00000000002A8000-memory.dmp

Filesize
96KB

Download
memory/2488-335-0x0000000000290000-0x00000000002A8000-memory.dmp

Filesize
96KB

Download
memory/2488-334-0x0000000000290000-0x00000000002A8000-memory.dmp

Filesize
96KB

Download
memory/2488-333-0x0000000000290000-0x00000000002A8000-memory.dmp

Filesize
96KB

Download
memory/2488-324-0x0000000000290000-0x00000000002A8000-memory.dmp

Filesize
96KB

Download
memory/2488-323-0x0000000000290000-0x00000000002A8000-memory.dmp

Filesize
96KB

Download
memory/2488-313-0x0000000000290000-0x00000000002A8000-memory.dmp

Filesize
96KB

Download
memory/2488-279-0x0000000000290000-0x00000000002A8000-memory.dmp

Filesize
96KB

Download
memory/2488-474-0x0000000000290000-0x00000000002A8000-memory.dmp

Filesize
96KB

Download
memory/2488-440-0x0000000000290000-0x00000000002A8000-memory.dmp

Filesize
96KB

Download
memory/2488-476-0x0000000000290000-0x00000000002A8000-memory.dmp

Filesize
96KB

Download
memory/2488-475-0x0000000000290000-0x00000000002A8000-memory.dmp

Filesize
96KB

Download
memory/2560-202-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2584-197-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2632-199-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2676-200-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2732-198-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2800-196-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2804-195-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2920-307-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2972-231-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2980-249-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/3000-209-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/3084-356-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/3200-380-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/3316-401-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/3384-412-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/3444-436-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/3492-446-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/3544-477-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download