e850b299c9ed14f9012b6d0b6c291eec0f881e090e75909df49bedc332f93c0a

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
22/07/2024, 07:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

62493729d141ed9cee1c0c999bfbfddc_JaffaCakes118.exe
Size

382KB
MD5

62493729d141ed9cee1c0c999bfbfddc
SHA1

849b56f0280a46a2f507897a34f77360bdf34e35
SHA256

e850b299c9ed14f9012b6d0b6c291eec0f881e090e75909df49bedc332f93c0a
SHA512

dc86a1eb30d07966bbb4d4d9d86cf2ed334b83432f3741ec8ef647adaa90ba36c6b9ce90defb088c5867041ae4372df5cbf7033b582fc19d340f59289d14ed7c
SSDEEP

6144:a4vsJmqBqv0qAqfbyxDkNDFYYtAeAbkZwTagAq3l0+wmDGgC:agqBG0qAqGxGxoQZwTaFOGH

Score

10^/10

evasion

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	tazebama.dl_

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	tazebama.dl_

Executes dropped EXE 64 IoCs

pid	Process
3064	tazebama.dl_
1632	tazebama.dl_
3000	tazebama.dl_
1396	tazebama.dl_
2648	tazebama.dl_
2052	tazebama.dl_
2836	tazebama.dl_
2660	tazebama.dl_
2668	tazebama.dl_
2008	tazebama.dl_
2804	tazebama.dl_
2608	tazebama.dl_
2580	tazebama.dl_
2536	tazebama.dl_
2756	tazebama.dl_
2600	tazebama.dl_
1968	tazebama.dl_
2524	tazebama.dl_
2000	tazebama.dl_
2132	tazebama.dl_
1516	tazebama.dl_
1648	tazebama.dl_
972	tazebama.dl_
1720	tazebama.dl_
936	tazebama.dl_
2748	tazebama.dl_
2692	tazebama.dl_
2088	tazebama.dl_
2316	tazebama.dl_
1948	tazebama.dl_
2824	tazebama.dl_
1696	tazebama.dl_
2700	tazebama.dl_
332	tazebama.dl_
1804	tazebama.dl_
2104	tazebama.dl_
2192	tazebama.dl_
2960	tazebama.dl_
2584	tazebama.dl_
3104	tazebama.dl_
3168	tazebama.dl_
3232	tazebama.dl_
3288	tazebama.dl_
3344	tazebama.dl_
3408	tazebama.dl_
3528	tazebama.dl_
3476	tazebama.dl_
3556	tazebama.dl_
3500	tazebama.dl_
3436	tazebama.dl_
3380	tazebama.dl_
3316	tazebama.dl_
3256	tazebama.dl_
3200	tazebama.dl_
3136	tazebama.dl_
1308	tazebama.dl_
2412	tazebama.dl_
2428	tazebama.dl_
1604	tazebama.dl_
2004	tazebama.dl_
1920	tazebama.dl_
2572	tazebama.dl_
2244	tazebama.dl_
2556	tazebama.dl_

Loads dropped DLL 64 IoCs

pid	Process
1712	62493729d141ed9cee1c0c999bfbfddc_JaffaCakes118.exe
1712	62493729d141ed9cee1c0c999bfbfddc_JaffaCakes118.exe
1712	62493729d141ed9cee1c0c999bfbfddc_JaffaCakes118.exe
1712	62493729d141ed9cee1c0c999bfbfddc_JaffaCakes118.exe
1712	62493729d141ed9cee1c0c999bfbfddc_JaffaCakes118.exe
1712	62493729d141ed9cee1c0c999bfbfddc_JaffaCakes118.exe
1712	62493729d141ed9cee1c0c999bfbfddc_JaffaCakes118.exe
1712	62493729d141ed9cee1c0c999bfbfddc_JaffaCakes118.exe
1712	62493729d141ed9cee1c0c999bfbfddc_JaffaCakes118.exe
1712	62493729d141ed9cee1c0c999bfbfddc_JaffaCakes118.exe
1712	62493729d141ed9cee1c0c999bfbfddc_JaffaCakes118.exe
1712	62493729d141ed9cee1c0c999bfbfddc_JaffaCakes118.exe
1712	62493729d141ed9cee1c0c999bfbfddc_JaffaCakes118.exe
1712	62493729d141ed9cee1c0c999bfbfddc_JaffaCakes118.exe
1712	62493729d141ed9cee1c0c999bfbfddc_JaffaCakes118.exe
1712	62493729d141ed9cee1c0c999bfbfddc_JaffaCakes118.exe
1712	62493729d141ed9cee1c0c999bfbfddc_JaffaCakes118.exe
1712	62493729d141ed9cee1c0c999bfbfddc_JaffaCakes118.exe
1712	62493729d141ed9cee1c0c999bfbfddc_JaffaCakes118.exe
1712	62493729d141ed9cee1c0c999bfbfddc_JaffaCakes118.exe
1712	62493729d141ed9cee1c0c999bfbfddc_JaffaCakes118.exe
1712	62493729d141ed9cee1c0c999bfbfddc_JaffaCakes118.exe
1712	62493729d141ed9cee1c0c999bfbfddc_JaffaCakes118.exe
1712	62493729d141ed9cee1c0c999bfbfddc_JaffaCakes118.exe
1712	62493729d141ed9cee1c0c999bfbfddc_JaffaCakes118.exe
1712	62493729d141ed9cee1c0c999bfbfddc_JaffaCakes118.exe
1712	62493729d141ed9cee1c0c999bfbfddc_JaffaCakes118.exe
1712	62493729d141ed9cee1c0c999bfbfddc_JaffaCakes118.exe
1712	62493729d141ed9cee1c0c999bfbfddc_JaffaCakes118.exe
1712	62493729d141ed9cee1c0c999bfbfddc_JaffaCakes118.exe
1712	62493729d141ed9cee1c0c999bfbfddc_JaffaCakes118.exe
1712	62493729d141ed9cee1c0c999bfbfddc_JaffaCakes118.exe
1712	62493729d141ed9cee1c0c999bfbfddc_JaffaCakes118.exe
1712	62493729d141ed9cee1c0c999bfbfddc_JaffaCakes118.exe
1712	62493729d141ed9cee1c0c999bfbfddc_JaffaCakes118.exe
1712	62493729d141ed9cee1c0c999bfbfddc_JaffaCakes118.exe
1712	62493729d141ed9cee1c0c999bfbfddc_JaffaCakes118.exe
1712	62493729d141ed9cee1c0c999bfbfddc_JaffaCakes118.exe
1712	62493729d141ed9cee1c0c999bfbfddc_JaffaCakes118.exe
1712	62493729d141ed9cee1c0c999bfbfddc_JaffaCakes118.exe
1712	62493729d141ed9cee1c0c999bfbfddc_JaffaCakes118.exe
1712	62493729d141ed9cee1c0c999bfbfddc_JaffaCakes118.exe
1712	62493729d141ed9cee1c0c999bfbfddc_JaffaCakes118.exe
1712	62493729d141ed9cee1c0c999bfbfddc_JaffaCakes118.exe
1712	62493729d141ed9cee1c0c999bfbfddc_JaffaCakes118.exe
1712	62493729d141ed9cee1c0c999bfbfddc_JaffaCakes118.exe
1712	62493729d141ed9cee1c0c999bfbfddc_JaffaCakes118.exe
1712	62493729d141ed9cee1c0c999bfbfddc_JaffaCakes118.exe
1712	62493729d141ed9cee1c0c999bfbfddc_JaffaCakes118.exe
1712	62493729d141ed9cee1c0c999bfbfddc_JaffaCakes118.exe
1712	62493729d141ed9cee1c0c999bfbfddc_JaffaCakes118.exe
1712	62493729d141ed9cee1c0c999bfbfddc_JaffaCakes118.exe
1712	62493729d141ed9cee1c0c999bfbfddc_JaffaCakes118.exe
1712	62493729d141ed9cee1c0c999bfbfddc_JaffaCakes118.exe
1712	62493729d141ed9cee1c0c999bfbfddc_JaffaCakes118.exe
1712	62493729d141ed9cee1c0c999bfbfddc_JaffaCakes118.exe
1712	62493729d141ed9cee1c0c999bfbfddc_JaffaCakes118.exe
1712	62493729d141ed9cee1c0c999bfbfddc_JaffaCakes118.exe
1712	62493729d141ed9cee1c0c999bfbfddc_JaffaCakes118.exe
1712	62493729d141ed9cee1c0c999bfbfddc_JaffaCakes118.exe
1712	62493729d141ed9cee1c0c999bfbfddc_JaffaCakes118.exe
1712	62493729d141ed9cee1c0c999bfbfddc_JaffaCakes118.exe
1712	62493729d141ed9cee1c0c999bfbfddc_JaffaCakes118.exe
1712	62493729d141ed9cee1c0c999bfbfddc_JaffaCakes118.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\V:	tazebama.dl_
File opened (read-only)	\??\R:	tazebama.dl_
File opened (read-only)	\??\N:	tazebama.dl_
File opened (read-only)	\??\I:	tazebama.dl_
File opened (read-only)	\??\H:	tazebama.dl_
File opened (read-only)	\??\G:	tazebama.dl_
File opened (read-only)	\??\X:	tazebama.dl_
File opened (read-only)	\??\S:	tazebama.dl_
File opened (read-only)	\??\P:	tazebama.dl_
File opened (read-only)	\??\J:	tazebama.dl_
File opened (read-only)	\??\Y:	tazebama.dl_
File opened (read-only)	\??\W:	tazebama.dl_
File opened (read-only)	\??\U:	tazebama.dl_
File opened (read-only)	\??\T:	tazebama.dl_
File opened (read-only)	\??\M:	tazebama.dl_
File opened (read-only)	\??\L:	tazebama.dl_
File opened (read-only)	\??\K:	tazebama.dl_
File opened (read-only)	\??\E:	tazebama.dl_
File opened (read-only)	\??\Z:	tazebama.dl_
File opened (read-only)	\??\O:	tazebama.dl_
File opened (read-only)	\??\Q:	tazebama.dl_

Drops autorun.inf file 1 TTPs 3 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	F:\autorun.inf	tazebama.dl_
File opened for modification	C:\autorun.inf	tazebama.dl_
File opened for modification	C:\Documents and Settings\Admin\Local Settings\Application Data\Microsoft\CD Burning\autorun.inf	tazebama.dl_

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File opened for modification	C:\PROGRA~2\MICROS~1\OFFICE14\OUTLOOK.EXE	tazebama.dl_
File opened for modification	C:\PROGRA~2\MICROS~1\OFFICE14\EXCEL.EXE	tazebama.dl_
File opened for modification	C:\PROGRA~2\MICROS~1\OFFICE14\GROOVE.EXE	tazebama.dl_
File opened for modification	C:\PROGRA~2\MICROS~1\OFFICE14\INFOPATH.EXE	tazebama.dl_
File opened for modification	C:\PROGRA~2\MICROS~1\OFFICE14\MSACCESS.EXE	tazebama.dl_
File opened for modification	C:\PROGRA~2\MICROS~1\OFFICE14\MSPUB.EXE	tazebama.dl_
File opened for modification	C:\PROGRA~2\MICROS~1\OFFICE14\OIS.EXE	tazebama.dl_
File opened for modification	C:\PROGRA~2\MICROS~1\OFFICE14\ONENOTE.EXE	tazebama.dl_

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1964	1768	WerFault.exe	178

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3064	tazebama.dl_
1632	tazebama.dl_
3000	tazebama.dl_
1396	tazebama.dl_
2648	tazebama.dl_
2052	tazebama.dl_
2836	tazebama.dl_
2668	tazebama.dl_
2660	tazebama.dl_
2008	tazebama.dl_
2804	tazebama.dl_
2608	tazebama.dl_
2580	tazebama.dl_
2536	tazebama.dl_
2756	tazebama.dl_
2600	tazebama.dl_
2524	tazebama.dl_
2000	tazebama.dl_
2132	tazebama.dl_
1516	tazebama.dl_
1648	tazebama.dl_
972	tazebama.dl_
1720	tazebama.dl_
936	tazebama.dl_
2748	tazebama.dl_
2692	tazebama.dl_
2088	tazebama.dl_
2316	tazebama.dl_
1948	tazebama.dl_
2824	tazebama.dl_
1968	tazebama.dl_
1696	tazebama.dl_
2700	tazebama.dl_
2700	tazebama.dl_
2700	tazebama.dl_
332	tazebama.dl_
332	tazebama.dl_
332	tazebama.dl_
1804	tazebama.dl_
1804	tazebama.dl_
1804	tazebama.dl_
2192	tazebama.dl_
2192	tazebama.dl_
2192	tazebama.dl_
2104	tazebama.dl_
2104	tazebama.dl_
2104	tazebama.dl_
2960	tazebama.dl_
2960	tazebama.dl_
2960	tazebama.dl_
2584	tazebama.dl_
2584	tazebama.dl_
2584	tazebama.dl_
3104	tazebama.dl_
3104	tazebama.dl_
3104	tazebama.dl_
3168	tazebama.dl_
3168	tazebama.dl_
3168	tazebama.dl_
3232	tazebama.dl_
3232	tazebama.dl_
3232	tazebama.dl_
3288	tazebama.dl_
3288	tazebama.dl_

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1712 wrote to memory of 3000	1712	62493729d141ed9cee1c0c999bfbfddc_JaffaCakes118.exe	31
PID 1712 wrote to memory of 3000	1712	62493729d141ed9cee1c0c999bfbfddc_JaffaCakes118.exe	31
PID 1712 wrote to memory of 3000	1712	62493729d141ed9cee1c0c999bfbfddc_JaffaCakes118.exe	31
PID 1712 wrote to memory of 3000	1712	62493729d141ed9cee1c0c999bfbfddc_JaffaCakes118.exe	31
PID 1712 wrote to memory of 3064	1712	62493729d141ed9cee1c0c999bfbfddc_JaffaCakes118.exe	32
PID 1712 wrote to memory of 3064	1712	62493729d141ed9cee1c0c999bfbfddc_JaffaCakes118.exe	32
PID 1712 wrote to memory of 3064	1712	62493729d141ed9cee1c0c999bfbfddc_JaffaCakes118.exe	32
PID 1712 wrote to memory of 3064	1712	62493729d141ed9cee1c0c999bfbfddc_JaffaCakes118.exe	32
PID 1712 wrote to memory of 1396	1712	62493729d141ed9cee1c0c999bfbfddc_JaffaCakes118.exe	33
PID 1712 wrote to memory of 1396	1712	62493729d141ed9cee1c0c999bfbfddc_JaffaCakes118.exe	33
PID 1712 wrote to memory of 1396	1712	62493729d141ed9cee1c0c999bfbfddc_JaffaCakes118.exe	33
PID 1712 wrote to memory of 1396	1712	62493729d141ed9cee1c0c999bfbfddc_JaffaCakes118.exe	33
PID 1712 wrote to memory of 1632	1712	62493729d141ed9cee1c0c999bfbfddc_JaffaCakes118.exe	34
PID 1712 wrote to memory of 1632	1712	62493729d141ed9cee1c0c999bfbfddc_JaffaCakes118.exe	34
PID 1712 wrote to memory of 1632	1712	62493729d141ed9cee1c0c999bfbfddc_JaffaCakes118.exe	34
PID 1712 wrote to memory of 1632	1712	62493729d141ed9cee1c0c999bfbfddc_JaffaCakes118.exe	34
PID 1712 wrote to memory of 2052	1712	62493729d141ed9cee1c0c999bfbfddc_JaffaCakes118.exe	35
PID 1712 wrote to memory of 2052	1712	62493729d141ed9cee1c0c999bfbfddc_JaffaCakes118.exe	35
PID 1712 wrote to memory of 2052	1712	62493729d141ed9cee1c0c999bfbfddc_JaffaCakes118.exe	35
PID 1712 wrote to memory of 2052	1712	62493729d141ed9cee1c0c999bfbfddc_JaffaCakes118.exe	35
PID 1712 wrote to memory of 2648	1712	62493729d141ed9cee1c0c999bfbfddc_JaffaCakes118.exe	36
PID 1712 wrote to memory of 2648	1712	62493729d141ed9cee1c0c999bfbfddc_JaffaCakes118.exe	36
PID 1712 wrote to memory of 2648	1712	62493729d141ed9cee1c0c999bfbfddc_JaffaCakes118.exe	36
PID 1712 wrote to memory of 2648	1712	62493729d141ed9cee1c0c999bfbfddc_JaffaCakes118.exe	36
PID 1712 wrote to memory of 2836	1712	62493729d141ed9cee1c0c999bfbfddc_JaffaCakes118.exe	37
PID 1712 wrote to memory of 2836	1712	62493729d141ed9cee1c0c999bfbfddc_JaffaCakes118.exe	37
PID 1712 wrote to memory of 2836	1712	62493729d141ed9cee1c0c999bfbfddc_JaffaCakes118.exe	37
PID 1712 wrote to memory of 2836	1712	62493729d141ed9cee1c0c999bfbfddc_JaffaCakes118.exe	37
PID 1712 wrote to memory of 2668	1712	62493729d141ed9cee1c0c999bfbfddc_JaffaCakes118.exe	38
PID 1712 wrote to memory of 2668	1712	62493729d141ed9cee1c0c999bfbfddc_JaffaCakes118.exe	38
PID 1712 wrote to memory of 2668	1712	62493729d141ed9cee1c0c999bfbfddc_JaffaCakes118.exe	38
PID 1712 wrote to memory of 2668	1712	62493729d141ed9cee1c0c999bfbfddc_JaffaCakes118.exe	38
PID 1712 wrote to memory of 2660	1712	62493729d141ed9cee1c0c999bfbfddc_JaffaCakes118.exe	39
PID 1712 wrote to memory of 2660	1712	62493729d141ed9cee1c0c999bfbfddc_JaffaCakes118.exe	39
PID 1712 wrote to memory of 2660	1712	62493729d141ed9cee1c0c999bfbfddc_JaffaCakes118.exe	39
PID 1712 wrote to memory of 2660	1712	62493729d141ed9cee1c0c999bfbfddc_JaffaCakes118.exe	39
PID 1712 wrote to memory of 2804	1712	62493729d141ed9cee1c0c999bfbfddc_JaffaCakes118.exe	40
PID 1712 wrote to memory of 2804	1712	62493729d141ed9cee1c0c999bfbfddc_JaffaCakes118.exe	40
PID 1712 wrote to memory of 2804	1712	62493729d141ed9cee1c0c999bfbfddc_JaffaCakes118.exe	40
PID 1712 wrote to memory of 2804	1712	62493729d141ed9cee1c0c999bfbfddc_JaffaCakes118.exe	40
PID 1712 wrote to memory of 2008	1712	62493729d141ed9cee1c0c999bfbfddc_JaffaCakes118.exe	41
PID 1712 wrote to memory of 2008	1712	62493729d141ed9cee1c0c999bfbfddc_JaffaCakes118.exe	41
PID 1712 wrote to memory of 2008	1712	62493729d141ed9cee1c0c999bfbfddc_JaffaCakes118.exe	41
PID 1712 wrote to memory of 2008	1712	62493729d141ed9cee1c0c999bfbfddc_JaffaCakes118.exe	41
PID 1712 wrote to memory of 2536	1712	62493729d141ed9cee1c0c999bfbfddc_JaffaCakes118.exe	42
PID 1712 wrote to memory of 2536	1712	62493729d141ed9cee1c0c999bfbfddc_JaffaCakes118.exe	42
PID 1712 wrote to memory of 2536	1712	62493729d141ed9cee1c0c999bfbfddc_JaffaCakes118.exe	42
PID 1712 wrote to memory of 2536	1712	62493729d141ed9cee1c0c999bfbfddc_JaffaCakes118.exe	42
PID 1712 wrote to memory of 2608	1712	62493729d141ed9cee1c0c999bfbfddc_JaffaCakes118.exe	43
PID 1712 wrote to memory of 2608	1712	62493729d141ed9cee1c0c999bfbfddc_JaffaCakes118.exe	43
PID 1712 wrote to memory of 2608	1712	62493729d141ed9cee1c0c999bfbfddc_JaffaCakes118.exe	43
PID 1712 wrote to memory of 2608	1712	62493729d141ed9cee1c0c999bfbfddc_JaffaCakes118.exe	43
PID 1712 wrote to memory of 1968	1712	62493729d141ed9cee1c0c999bfbfddc_JaffaCakes118.exe	44
PID 1712 wrote to memory of 1968	1712	62493729d141ed9cee1c0c999bfbfddc_JaffaCakes118.exe	44
PID 1712 wrote to memory of 1968	1712	62493729d141ed9cee1c0c999bfbfddc_JaffaCakes118.exe	44
PID 1712 wrote to memory of 1968	1712	62493729d141ed9cee1c0c999bfbfddc_JaffaCakes118.exe	44
PID 1712 wrote to memory of 2580	1712	62493729d141ed9cee1c0c999bfbfddc_JaffaCakes118.exe	45
PID 1712 wrote to memory of 2580	1712	62493729d141ed9cee1c0c999bfbfddc_JaffaCakes118.exe	45
PID 1712 wrote to memory of 2580	1712	62493729d141ed9cee1c0c999bfbfddc_JaffaCakes118.exe	45
PID 1712 wrote to memory of 2580	1712	62493729d141ed9cee1c0c999bfbfddc_JaffaCakes118.exe	45
PID 1712 wrote to memory of 2524	1712	62493729d141ed9cee1c0c999bfbfddc_JaffaCakes118.exe	46
PID 1712 wrote to memory of 2524	1712	62493729d141ed9cee1c0c999bfbfddc_JaffaCakes118.exe	46
PID 1712 wrote to memory of 2524	1712	62493729d141ed9cee1c0c999bfbfddc_JaffaCakes118.exe	46
PID 1712 wrote to memory of 2524	1712	62493729d141ed9cee1c0c999bfbfddc_JaffaCakes118.exe	46

C:\Users\Admin\AppData\Local\Temp\62493729d141ed9cee1c0c999bfbfddc_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\62493729d141ed9cee1c0c999bfbfddc_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1712
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:3000
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:3064
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:1396
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:1632
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2052
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2648
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2836
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2668
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2660
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2804
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2008
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2536
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2608
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:1968
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2580
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2524
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2756
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2000
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2600
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2360
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2132
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2028
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:1516
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:804
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:1648
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2912
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:972
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:484
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:1720
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:1764
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:936
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:1780
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2748
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2480
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2692
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2156
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2088
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:1756
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2316
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:924
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:1948
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2796
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2824
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  PID:2556
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:1696
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  PID:2244
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2700
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:332
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  PID:1920
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:1804
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  PID:2004
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2104
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2192
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2960
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2584
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  PID:1308
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:3104
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  PID:3136
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:3168
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  PID:3200
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:3232
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  PID:3256
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:3288
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  PID:3316
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  PID:3344
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  PID:3380
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  PID:3408
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  PID:3436
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  PID:3476
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  PID:3500
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  PID:3528
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  PID:3556
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3588
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3960
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3988
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4016
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4040
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4064
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2728
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:1984
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2780
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2672
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2496
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3024
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2532
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2092
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2576
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3128
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3244
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3312
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3552
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2644
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:1064
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2764
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:1652
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3028
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:852
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:1952
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2068
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3488
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:1700
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3160
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3400
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3584
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3568
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3396
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:1172
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2552
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3216
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3632
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3092
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3792
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:632
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:1100
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:304
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:776
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:1128
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3952
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3948
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:1084
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3976
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2968
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3144
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2056
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:1820
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4080
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2940
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:1304
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2264
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2676
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:1704
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2932
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3020
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2864
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3284
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3576
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3332
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3176
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4056
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2544
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2228
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3120
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2072
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Enumerates connected drives
  - Drops autorun.inf file
  - Drops file in Program Files directory
  PID:1768
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1768 -s 320
    3⤵
    - Program crash
    PID:1964
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2684
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:1564
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2276
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2628
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:876
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2128
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:1612
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3896
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3908
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3920
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2872
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2180
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3820
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2168
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:656
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3716
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3432
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2348
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2760
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3164
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3956
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:1992
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:1708
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3544
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3032
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3368
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:1596
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:1792
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:1244
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2116
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3836
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3856
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2948
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:1620
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3340
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:1836
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3196
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3508
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3860
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4024
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:1380
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2016
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3376
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3156
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3604
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3264
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2744
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3428
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2540
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4088
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3132
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:980
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2124
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2808
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2688
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3880
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3972
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:1956
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:792
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:280
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2980
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3936
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2908
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2740
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3984
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:356
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:316
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2652
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3600
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2388
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:764
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:988
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2236
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3296
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:1800
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2012
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2776
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3352
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2768
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4092
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3828
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2952
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:1876
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:1192
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3416
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3816
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2284
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4120
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4132
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4152
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4164
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4176
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4188
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4200
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4320
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4332
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4344
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4356
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4368
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4380
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4392
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4412
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4436
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4448
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4460
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4472
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4488
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4500
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4512
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4524
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4536
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4548
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4560
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4628
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4640
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4652
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4664
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4680
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4700
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4716
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4728
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4744
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4756
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4768
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4780
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4792
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4804
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4816
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4828
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4840
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4852
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4864
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4876
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4888
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4900
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4912
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4924
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4936
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4948
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4960
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4972
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4984
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4996
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:5008
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:5020
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:5032
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:5044
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:5056
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:5068
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:5080
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:5092
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:5104
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:5116
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3012
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2076
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2856
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3892
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3548
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2420
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3304
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3052
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3872
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:1088
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4100
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2096
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4112
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4144
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4196
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2636
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:1664
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3492
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3512
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2656
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2432
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4048
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2820
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3228
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:1300
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3148
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2840
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4184
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4216
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4228
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4240
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4252
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4264
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4276
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4288
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4300
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4312
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4400
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4376
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4468
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4544
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4364
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4424
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4456
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4508
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4580
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4588
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4604
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4624
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4660
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4692
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4708
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4736
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4764
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4824
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4896
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4812
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4860
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4932
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:5016
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:5088
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4956
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:5028
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:5100
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:780
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3388
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3928
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2708
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:856
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4172
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2640
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4008
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2160
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4248
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4296
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4432
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4284
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4520
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4572
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4636
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4712
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4872
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4944
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4036
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4140
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4212
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:1204
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3848
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4260
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4752
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:5128
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:5140
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:5152

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\autorun.inf

Filesize
126B

MD5
163e20cbccefcdd42f46e43a94173c46

SHA1
4c7b5048e8608e2a75799e00ecf1bbb4773279ae

SHA256
7780bee9df142a17e0457f3dcb2788b50fc2792370089335597d33719126fb7e

SHA512
e5ac0ff6b087857799ab70f68067c9dc73eeb93ccfcad87047052380b95ade3e6eb2a7d01a0f850d548a39f4b1ebb60e299d603dbe25c31b9a3585b34a0c65a8

Download Submit
C:\zPharaoh.exe

Filesize
157KB

MD5
6e7d20236148687bbcd83e1fcc02815c

SHA1
a6b565328313de3273d534666818fdaea840c479

SHA256
bbe1491676ed9b0c4e9c978cbc479fbf04d66cd219a27a5d327ec55465b30251

SHA512
4c761fe7fee1eea38d23c6ae02bdec9afe6a9ca9a70f6e6d529daa7a0da8903ef354ec9db23281b85d77cfecbcea87abf6399cf06c3ca80a7dcf3c163ff1616f

Download Submit
F:\zPharaoh.exe

Filesize
157KB

MD5
b9d4bda66143f62d0ba783f4f9c40142

SHA1
b73af2a0c37374c85643baa8c82ad275e6e54e61

SHA256
2ebe1c94c6cb29b334d236c41e35e3799d2f481283a56acda42d45c483ba2ee9

SHA512
9ce81aac708d2106c1cc113162781dadd5663691f0767e10232ec1e19c18e921fd1f120bcd6541a47395a79391264dabda12d3261652ec430b2c5723fdd9a29e

Download Submit
\Users\tazebama.dl_

Filesize
157KB

MD5
7ad28b3622198870b43e50fc9893e5b0

SHA1
a3ab1fd83de96c2ebf1138c974ea1736dd04d1fe

SHA256
21455555e3654c57c0fddd872945cba78920dd59bdc1b5845679258e05ef065a

SHA512
a029af858d33f22ad1fe00c95fdbc61c5398ebeacce4f3336bd01e34f50218e2a42d36e01abaf5b94c7278ae1e4965185b84b59ccbfa74f59e9bbab08cece5dd

Download Submit
\Users\tazebama.dll

Filesize
32KB

MD5
b6a03576e595afacb37ada2f1d5a0529

SHA1
d598d4d0e70dec2ffa2849edaeb4db94fedcc0b8

SHA256
1707eaf60aa91f3791aa5643bfa038e9d8141878d61f5d701ebac51f4ae7aaad

SHA512
181b7cc6479352fe2c53c3630d45a839cdeb74708be6709c2a75847a54de3ffc1fdac8450270dde7174ecb23e5cb002f8ce39032429a3112b1202f3381b8918c

Download Submit
memory/332-468-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/936-231-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/972-213-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/1396-138-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/1396-136-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/1516-193-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/1632-133-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/1648-204-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/1696-324-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/1712-184-0x0000000000220000-0x0000000000238000-memory.dmp

Filesize
96KB

Download
memory/1712-129-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1712-333-0x0000000000220000-0x0000000000238000-memory.dmp

Filesize
96KB

Download
memory/1712-346-0x0000000000220000-0x0000000000238000-memory.dmp

Filesize
96KB

Download
memory/1712-278-0x0000000000220000-0x0000000000238000-memory.dmp

Filesize
96KB

Download
memory/1712-77-0x0000000000220000-0x0000000000238000-memory.dmp

Filesize
96KB

Download
memory/1712-80-0x0000000000220000-0x0000000000238000-memory.dmp

Filesize
96KB

Download
memory/1712-83-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1712-258-0x0000000000220000-0x0000000000238000-memory.dmp

Filesize
96KB

Download
memory/1712-87-0x0000000000220000-0x0000000000238000-memory.dmp

Filesize
96KB

Download
memory/1712-96-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1712-350-0x0000000000220000-0x0000000000238000-memory.dmp

Filesize
96KB

Download
memory/1712-0-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1712-352-0x0000000000220000-0x0000000000238000-memory.dmp

Filesize
96KB

Download
memory/1712-360-0x0000000000220000-0x0000000000238000-memory.dmp

Filesize
96KB

Download
memory/1712-195-0x0000000000220000-0x0000000000238000-memory.dmp

Filesize
96KB

Download
memory/1712-194-0x0000000000220000-0x0000000000238000-memory.dmp

Filesize
96KB

Download
memory/1712-371-0x0000000000220000-0x0000000000238000-memory.dmp

Filesize
96KB

Download
memory/1712-357-0x0000000000220000-0x0000000000238000-memory.dmp

Filesize
96KB

Download
memory/1712-183-0x0000000000220000-0x0000000000238000-memory.dmp

Filesize
96KB

Download
memory/1712-182-0x0000000000220000-0x0000000000238000-memory.dmp

Filesize
96KB

Download
memory/1712-113-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1712-292-0x0000000000220000-0x0000000000238000-memory.dmp

Filesize
96KB

Download
memory/1712-293-0x0000000000220000-0x0000000000238000-memory.dmp

Filesize
96KB

Download
memory/1712-294-0x0000000000220000-0x0000000000238000-memory.dmp

Filesize
96KB

Download
memory/1712-338-0x0000000000220000-0x0000000000238000-memory.dmp

Filesize
96KB

Download
memory/1712-375-0x0000000000220000-0x0000000000238000-memory.dmp

Filesize
96KB

Download
memory/1712-382-0x0000000000220000-0x0000000000238000-memory.dmp

Filesize
96KB

Download
memory/1712-383-0x0000000000220000-0x0000000000238000-memory.dmp

Filesize
96KB

Download
memory/1712-339-0x0000000000220000-0x0000000000238000-memory.dmp

Filesize
96KB

Download
memory/1712-343-0x0000000000220000-0x0000000000238000-memory.dmp

Filesize
96KB

Download
memory/1712-345-0x0000000000220000-0x0000000000238000-memory.dmp

Filesize
96KB

Download
memory/1712-106-0x0000000000220000-0x0000000000238000-memory.dmp

Filesize
96KB

Download
memory/1712-388-0x0000000000220000-0x0000000000238000-memory.dmp

Filesize
96KB

Download
memory/1712-353-0x0000000000220000-0x0000000000238000-memory.dmp

Filesize
96KB

Download
memory/1712-466-0x0000000000220000-0x0000000000238000-memory.dmp

Filesize
96KB

Download
memory/1712-465-0x0000000000220000-0x0000000000238000-memory.dmp

Filesize
96KB

Download
memory/1712-464-0x0000000000220000-0x0000000000238000-memory.dmp

Filesize
96KB

Download
memory/1712-444-0x0000000000220000-0x0000000000238000-memory.dmp

Filesize
96KB

Download
memory/1712-437-0x0000000000220000-0x0000000000238000-memory.dmp

Filesize
96KB

Download
memory/1712-427-0x0000000000220000-0x0000000000238000-memory.dmp

Filesize
96KB

Download
memory/1712-424-0x0000000000220000-0x0000000000238000-memory.dmp

Filesize
96KB

Download
memory/1712-421-0x0000000000220000-0x0000000000238000-memory.dmp

Filesize
96KB

Download
memory/1712-411-0x0000000000220000-0x0000000000238000-memory.dmp

Filesize
96KB

Download
memory/1712-390-0x0000000000220000-0x0000000000238000-memory.dmp

Filesize
96KB

Download
memory/1712-389-0x0000000000220000-0x0000000000238000-memory.dmp

Filesize
96KB

Download
memory/1712-377-0x0000000000220000-0x0000000000238000-memory.dmp

Filesize
96KB

Download
memory/1712-369-0x0000000000220000-0x0000000000238000-memory.dmp

Filesize
96KB

Download
memory/1712-365-0x0000000000220000-0x0000000000238000-memory.dmp

Filesize
96KB

Download
memory/1712-358-0x0000000000220000-0x0000000000238000-memory.dmp

Filesize
96KB

Download
memory/1720-222-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/1804-469-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/1948-277-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/1968-299-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2000-167-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2008-150-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2052-142-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2088-259-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2104-471-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2132-181-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2192-470-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2316-268-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2524-165-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2536-158-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2580-157-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2584-473-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2600-163-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2608-155-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2648-139-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2648-141-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2660-148-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2668-147-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2692-249-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2700-467-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2748-240-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2756-161-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2804-152-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2824-291-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2836-146-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2960-472-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/3000-134-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/3064-131-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/3104-474-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/3168-475-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/3232-476-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/3288-477-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/3408-478-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download