4342ad06cc9b14e0c2c6de0edcd9d3af7ccdccc4b11552ba7152be45c80d549c

Analysis

max time kernel
44s
max time network
126s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
08/09/2024, 14:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d4974a781ecbc5e976d707eb62332c03_JaffaCakes118.exe
Size

15KB
MD5

d4974a781ecbc5e976d707eb62332c03
SHA1

913a8c25c2dd31d3ba5c45c2818dab7fa189a902
SHA256

4342ad06cc9b14e0c2c6de0edcd9d3af7ccdccc4b11552ba7152be45c80d549c
SHA512

59bb229acf3574b5ae797d5ec7cde8268af62cfbadbf41318a01a77249cd9f885da624092bf452f4408328877d8ff32bf9d214e807c71bb4bbc824cc7368ca72
SSDEEP

192:ycAwpYUPtg7XiOoAHfipMQPZ9lZdJrU+3dwQQkHbvghsw/3CXHGyU2s7S6bL:yzE4i0fYPZ/tUFQQkHblw/3iHGypqSy

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2408	agetlktz.exe
2172	agetlktz.exe
2700	agetlktz.exe
2712	agetlktz.exe
2720	agetlktz.exe
2624	agetlktz.exe
1676	agetlktz.exe
2448	agetlktz.exe
924	agetlktz.exe
1932	agetlktz.exe
2880	agetlktz.exe
2424	agetlktz.exe
1072	agetlktz.exe
2312	agetlktz.exe
1980	agetlktz.exe
1052	agetlktz.exe
2024	agetlktz.exe
1560	agetlktz.exe
900	agetlktz.exe
2988	agetlktz.exe
512	agetlktz.exe
544	agetlktz.exe
1284	agetlktz.exe
2296	agetlktz.exe
1596	agetlktz.exe
2408	agetlktz.exe
2240	agetlktz.exe
2980	agetlktz.exe
2856	agetlktz.exe
2688	agetlktz.exe
2568	agetlktz.exe
2528	agetlktz.exe
1948	agetlktz.exe
1664	agetlktz.exe
2292	agetlktz.exe
1900	agetlktz.exe
2912	agetlktz.exe
2372	agetlktz.exe
2896	agetlktz.exe
1152	agetlktz.exe
1060	agetlktz.exe
1944	agetlktz.exe
2000	agetlktz.exe
1052	agetlktz.exe
2412	agetlktz.exe
1560	agetlktz.exe
1116	agetlktz.exe
864	agetlktz.exe
2152	agetlktz.exe
544	agetlktz.exe
1284	agetlktz.exe
1608	agetlktz.exe
2800	agetlktz.exe
2676	agetlktz.exe
1444	agetlktz.exe
2120	agetlktz.exe
2620	agetlktz.exe
3064	agetlktz.exe
2624	agetlktz.exe
2456	agetlktz.exe
1144	agetlktz.exe
1904	agetlktz.exe
2864	agetlktz.exe
2924	agetlktz.exe

Loads dropped DLL 64 IoCs

pid	Process
1804	d4974a781ecbc5e976d707eb62332c03_JaffaCakes118.exe
1804	d4974a781ecbc5e976d707eb62332c03_JaffaCakes118.exe
2408	agetlktz.exe
2408	agetlktz.exe
2408	agetlktz.exe
2172	agetlktz.exe
2172	agetlktz.exe
2172	agetlktz.exe
2700	agetlktz.exe
2700	agetlktz.exe
2700	agetlktz.exe
2712	agetlktz.exe
2712	agetlktz.exe
2712	agetlktz.exe
2720	agetlktz.exe
2720	agetlktz.exe
2720	agetlktz.exe
2624	agetlktz.exe
2624	agetlktz.exe
2624	agetlktz.exe
1676	agetlktz.exe
1676	agetlktz.exe
1676	agetlktz.exe
2448	agetlktz.exe
2448	agetlktz.exe
2448	agetlktz.exe
924	agetlktz.exe
924	agetlktz.exe
924	agetlktz.exe
1932	agetlktz.exe
1932	agetlktz.exe
1932	agetlktz.exe
2880	agetlktz.exe
2880	agetlktz.exe
2880	agetlktz.exe
2424	agetlktz.exe
2424	agetlktz.exe
2424	agetlktz.exe
1072	agetlktz.exe
1072	agetlktz.exe
1072	agetlktz.exe
2312	agetlktz.exe
2312	agetlktz.exe
2312	agetlktz.exe
1980	agetlktz.exe
1980	agetlktz.exe
1980	agetlktz.exe
1052	agetlktz.exe
1052	agetlktz.exe
1052	agetlktz.exe
2024	agetlktz.exe
2024	agetlktz.exe
2024	agetlktz.exe
1560	agetlktz.exe
1560	agetlktz.exe
1560	agetlktz.exe
900	agetlktz.exe
900	agetlktz.exe
900	agetlktz.exe
2988	agetlktz.exe
2988	agetlktz.exe
2988	agetlktz.exe
512	agetlktz.exe
512	agetlktz.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\agetlktz.exe	agetlktz.exe
File opened for modification	C:\Windows\SysWOW64\agetlktz.exe	agetlktz.exe
File created	C:\Windows\SysWOW64\agetlktz.exe	agetlktz.exe
File opened for modification	C:\Windows\SysWOW64\agetlktz.exe	agetlktz.exe
File created	C:\Windows\SysWOW64\agetlktz.exe	agetlktz.exe
File opened for modification	C:\Windows\SysWOW64\agetlktz.exe	agetlktz.exe
File created	C:\Windows\SysWOW64\agetlktz.exe	agetlktz.exe
File created	C:\Windows\SysWOW64\agetlktz.exe	agetlktz.exe
File opened for modification	C:\Windows\SysWOW64\agetlktz.exe	agetlktz.exe
File created	C:\Windows\SysWOW64\agetlktz.exe	agetlktz.exe
File created	C:\Windows\SysWOW64\agetlktz.exe	agetlktz.exe
File created	C:\Windows\SysWOW64\agetlktz.exe	agetlktz.exe
File created	C:\Windows\SysWOW64\agetlktz.exe	agetlktz.exe
File opened for modification	C:\Windows\SysWOW64\agetlktz.exe	agetlktz.exe
File created	C:\Windows\SysWOW64\agetlktz.exe	agetlktz.exe
File opened for modification	C:\Windows\SysWOW64\agetlktz.exe	agetlktz.exe
File opened for modification	C:\Windows\SysWOW64\agetlktz.exe	agetlktz.exe
File opened for modification	C:\Windows\SysWOW64\agetlktz.exe	agetlktz.exe
File created	C:\Windows\SysWOW64\agetlktz.exe	agetlktz.exe
File opened for modification	C:\Windows\SysWOW64\agetlktz.exe	agetlktz.exe
File created	C:\Windows\SysWOW64\agetlktz.exe	agetlktz.exe
File opened for modification	C:\Windows\SysWOW64\agetlktz.exe	agetlktz.exe
File created	C:\Windows\SysWOW64\agetlktz.exe	agetlktz.exe
File opened for modification	C:\Windows\SysWOW64\agetlktz.exe	agetlktz.exe
File created	C:\Windows\SysWOW64\agetlktz.exe	agetlktz.exe
File created	C:\Windows\SysWOW64\agetlktz.exe	agetlktz.exe
File opened for modification	C:\Windows\SysWOW64\agetlktz.exe	agetlktz.exe
File created	C:\Windows\SysWOW64\agetlktz.exe	agetlktz.exe
File opened for modification	C:\Windows\SysWOW64\agetlktz.exe	agetlktz.exe
File created	C:\Windows\SysWOW64\agetlktz.exe	agetlktz.exe
File created	C:\Windows\SysWOW64\agetlktz.exe	agetlktz.exe
File created	C:\Windows\SysWOW64\agetlktz.exe	agetlktz.exe
File opened for modification	C:\Windows\SysWOW64\agetlktz.exe	agetlktz.exe
File opened for modification	C:\Windows\SysWOW64\agetlktz.exe	agetlktz.exe
File opened for modification	C:\Windows\SysWOW64\agetlktz.exe	agetlktz.exe
File opened for modification	C:\Windows\SysWOW64\agetlktz.exe	agetlktz.exe
File created	C:\Windows\SysWOW64\agetlktz.exe	agetlktz.exe
File created	C:\Windows\SysWOW64\agetlktz.exe	agetlktz.exe
File opened for modification	C:\Windows\SysWOW64\agetlktz.exe	agetlktz.exe
File created	C:\Windows\SysWOW64\agetlktz.exe	agetlktz.exe
File created	C:\Windows\SysWOW64\agetlktz.exe	agetlktz.exe
File created	C:\Windows\SysWOW64\agetlktz.exe	agetlktz.exe
File created	C:\Windows\SysWOW64\agetlktz.exe	agetlktz.exe
File opened for modification	C:\Windows\SysWOW64\agetlktz.exe	agetlktz.exe
File created	C:\Windows\SysWOW64\agetlktz.exe	agetlktz.exe
File opened for modification	C:\Windows\SysWOW64\agetlktz.exe	agetlktz.exe
File opened for modification	C:\Windows\SysWOW64\agetlktz.exe	agetlktz.exe
File opened for modification	C:\Windows\SysWOW64\agetlktz.exe	agetlktz.exe
File created	C:\Windows\SysWOW64\agetlktz.exe	agetlktz.exe
File created	C:\Windows\SysWOW64\agetlktz.exe	agetlktz.exe
File created	C:\Windows\SysWOW64\agetlktz.exe	agetlktz.exe
File created	C:\Windows\SysWOW64\agetlktz.exe	agetlktz.exe
File opened for modification	C:\Windows\SysWOW64\agetlktz.exe	agetlktz.exe
File created	C:\Windows\SysWOW64\agetlktz.exe	agetlktz.exe
File opened for modification	C:\Windows\SysWOW64\agetlktz.exe	agetlktz.exe
File opened for modification	C:\Windows\SysWOW64\agetlktz.exe	agetlktz.exe
File created	C:\Windows\SysWOW64\agetlktz.exe	agetlktz.exe
File opened for modification	C:\Windows\SysWOW64\agetlktz.exe	agetlktz.exe
File created	C:\Windows\SysWOW64\agetlktz.exe	agetlktz.exe
File opened for modification	C:\Windows\SysWOW64\agetlktz.exe	agetlktz.exe
File opened for modification	C:\Windows\SysWOW64\agetlktz.exe	agetlktz.exe
File created	C:\Windows\SysWOW64\agetlktz.exe	agetlktz.exe
File opened for modification	C:\Windows\SysWOW64\agetlktz.exe	agetlktz.exe
File opened for modification	C:\Windows\SysWOW64\agetlktz.exe	agetlktz.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agetlktz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agetlktz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agetlktz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agetlktz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agetlktz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agetlktz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agetlktz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agetlktz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agetlktz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agetlktz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agetlktz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agetlktz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agetlktz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agetlktz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agetlktz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agetlktz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agetlktz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agetlktz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agetlktz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agetlktz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agetlktz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agetlktz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agetlktz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agetlktz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agetlktz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agetlktz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agetlktz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agetlktz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d4974a781ecbc5e976d707eb62332c03_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agetlktz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agetlktz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agetlktz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agetlktz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agetlktz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agetlktz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agetlktz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agetlktz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agetlktz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agetlktz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agetlktz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agetlktz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agetlktz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agetlktz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agetlktz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agetlktz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agetlktz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agetlktz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agetlktz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agetlktz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agetlktz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agetlktz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agetlktz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agetlktz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agetlktz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agetlktz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agetlktz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agetlktz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agetlktz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agetlktz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agetlktz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agetlktz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agetlktz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agetlktz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agetlktz.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
1804	d4974a781ecbc5e976d707eb62332c03_JaffaCakes118.exe
1804	d4974a781ecbc5e976d707eb62332c03_JaffaCakes118.exe
2408	agetlktz.exe
2408	agetlktz.exe
2172	agetlktz.exe
2172	agetlktz.exe
2700	agetlktz.exe
2700	agetlktz.exe
2712	agetlktz.exe
2712	agetlktz.exe
2720	agetlktz.exe
2720	agetlktz.exe
2624	agetlktz.exe
2624	agetlktz.exe
1676	agetlktz.exe
1676	agetlktz.exe
2448	agetlktz.exe
2448	agetlktz.exe
924	agetlktz.exe
924	agetlktz.exe
1932	agetlktz.exe
1932	agetlktz.exe
2880	agetlktz.exe
2880	agetlktz.exe
2424	agetlktz.exe
2424	agetlktz.exe
1072	agetlktz.exe
1072	agetlktz.exe
2312	agetlktz.exe
2312	agetlktz.exe
1980	agetlktz.exe
1980	agetlktz.exe
1052	agetlktz.exe
1052	agetlktz.exe
2024	agetlktz.exe
2024	agetlktz.exe
1560	agetlktz.exe
1560	agetlktz.exe
900	agetlktz.exe
900	agetlktz.exe
2988	agetlktz.exe
2988	agetlktz.exe
512	agetlktz.exe
512	agetlktz.exe
544	agetlktz.exe
544	agetlktz.exe
1284	agetlktz.exe
1284	agetlktz.exe
2296	agetlktz.exe
2296	agetlktz.exe
1596	agetlktz.exe
1596	agetlktz.exe
2408	agetlktz.exe
2408	agetlktz.exe
2240	agetlktz.exe
2240	agetlktz.exe
2980	agetlktz.exe
2980	agetlktz.exe
2856	agetlktz.exe
2856	agetlktz.exe
2688	agetlktz.exe
2688	agetlktz.exe
2568	agetlktz.exe
2568	agetlktz.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1804 wrote to memory of 2408	1804	d4974a781ecbc5e976d707eb62332c03_JaffaCakes118.exe	30
PID 1804 wrote to memory of 2408	1804	d4974a781ecbc5e976d707eb62332c03_JaffaCakes118.exe	30
PID 1804 wrote to memory of 2408	1804	d4974a781ecbc5e976d707eb62332c03_JaffaCakes118.exe	30
PID 1804 wrote to memory of 2408	1804	d4974a781ecbc5e976d707eb62332c03_JaffaCakes118.exe	30
PID 2408 wrote to memory of 2172	2408	agetlktz.exe	31
PID 2408 wrote to memory of 2172	2408	agetlktz.exe	31
PID 2408 wrote to memory of 2172	2408	agetlktz.exe	31
PID 2408 wrote to memory of 2172	2408	agetlktz.exe	31
PID 2172 wrote to memory of 2700	2172	agetlktz.exe	32
PID 2172 wrote to memory of 2700	2172	agetlktz.exe	32
PID 2172 wrote to memory of 2700	2172	agetlktz.exe	32
PID 2172 wrote to memory of 2700	2172	agetlktz.exe	32
PID 2700 wrote to memory of 2712	2700	agetlktz.exe	33
PID 2700 wrote to memory of 2712	2700	agetlktz.exe	33
PID 2700 wrote to memory of 2712	2700	agetlktz.exe	33
PID 2700 wrote to memory of 2712	2700	agetlktz.exe	33
PID 2712 wrote to memory of 2720	2712	agetlktz.exe	34
PID 2712 wrote to memory of 2720	2712	agetlktz.exe	34
PID 2712 wrote to memory of 2720	2712	agetlktz.exe	34
PID 2712 wrote to memory of 2720	2712	agetlktz.exe	34
PID 2720 wrote to memory of 2624	2720	agetlktz.exe	35
PID 2720 wrote to memory of 2624	2720	agetlktz.exe	35
PID 2720 wrote to memory of 2624	2720	agetlktz.exe	35
PID 2720 wrote to memory of 2624	2720	agetlktz.exe	35
PID 2624 wrote to memory of 1676	2624	agetlktz.exe	36
PID 2624 wrote to memory of 1676	2624	agetlktz.exe	36
PID 2624 wrote to memory of 1676	2624	agetlktz.exe	36
PID 2624 wrote to memory of 1676	2624	agetlktz.exe	36
PID 1676 wrote to memory of 2448	1676	agetlktz.exe	38
PID 1676 wrote to memory of 2448	1676	agetlktz.exe	38
PID 1676 wrote to memory of 2448	1676	agetlktz.exe	38
PID 1676 wrote to memory of 2448	1676	agetlktz.exe	38
PID 2448 wrote to memory of 924	2448	agetlktz.exe	39
PID 2448 wrote to memory of 924	2448	agetlktz.exe	39
PID 2448 wrote to memory of 924	2448	agetlktz.exe	39
PID 2448 wrote to memory of 924	2448	agetlktz.exe	39
PID 924 wrote to memory of 1932	924	agetlktz.exe	40
PID 924 wrote to memory of 1932	924	agetlktz.exe	40
PID 924 wrote to memory of 1932	924	agetlktz.exe	40
PID 924 wrote to memory of 1932	924	agetlktz.exe	40
PID 1932 wrote to memory of 2880	1932	agetlktz.exe	41
PID 1932 wrote to memory of 2880	1932	agetlktz.exe	41
PID 1932 wrote to memory of 2880	1932	agetlktz.exe	41
PID 1932 wrote to memory of 2880	1932	agetlktz.exe	41
PID 2880 wrote to memory of 2424	2880	agetlktz.exe	42
PID 2880 wrote to memory of 2424	2880	agetlktz.exe	42
PID 2880 wrote to memory of 2424	2880	agetlktz.exe	42
PID 2880 wrote to memory of 2424	2880	agetlktz.exe	42
PID 2424 wrote to memory of 1072	2424	agetlktz.exe	43
PID 2424 wrote to memory of 1072	2424	agetlktz.exe	43
PID 2424 wrote to memory of 1072	2424	agetlktz.exe	43
PID 2424 wrote to memory of 1072	2424	agetlktz.exe	43
PID 1072 wrote to memory of 2312	1072	agetlktz.exe	44
PID 1072 wrote to memory of 2312	1072	agetlktz.exe	44
PID 1072 wrote to memory of 2312	1072	agetlktz.exe	44
PID 1072 wrote to memory of 2312	1072	agetlktz.exe	44
PID 2312 wrote to memory of 1980	2312	agetlktz.exe	45
PID 2312 wrote to memory of 1980	2312	agetlktz.exe	45
PID 2312 wrote to memory of 1980	2312	agetlktz.exe	45
PID 2312 wrote to memory of 1980	2312	agetlktz.exe	45
PID 1980 wrote to memory of 1052	1980	agetlktz.exe	74
PID 1980 wrote to memory of 1052	1980	agetlktz.exe	74
PID 1980 wrote to memory of 1052	1980	agetlktz.exe	74
PID 1980 wrote to memory of 1052	1980	agetlktz.exe	74

C:\Users\Admin\AppData\Local\Temp\d4974a781ecbc5e976d707eb62332c03_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d4974a781ecbc5e976d707eb62332c03_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1804
- C:\Windows\SysWOW64\agetlktz.exe
  "C:\Windows\system32\agetlktz.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2408
- - C:\Windows\SysWOW64\agetlktz.exe
    "C:\Windows\system32\agetlktz.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2172
  - - C:\Windows\SysWOW64\agetlktz.exe
      "C:\Windows\system32\agetlktz.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2700
    - - C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2712
      - C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2720
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2624
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1676
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        9⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2448
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        10⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:924
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        11⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1932
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        12⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2880
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        13⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2424
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        14⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1072
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        15⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2312
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        16⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1980
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        17⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1052
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        18⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2024
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        19⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1560
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        20⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious use of SetWindowsHookEx
        
        PID:900
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        21⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2988
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        22⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:512
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        23⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:544
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        24⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1284
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        25⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2296
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        26⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of SetWindowsHookEx
        
        PID:1596
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        27⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2408
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        28⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2240
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        29⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2980
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        30⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2856
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        31⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2688
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        32⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2568
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        33⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2528
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        34⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1948
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        35⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1664
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        36⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2292
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        37⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1900
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        38⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2912
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        39⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2372
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        40⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2896
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        41⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1152
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        42⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1060
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        43⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1944
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        44⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2000
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        45⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1052
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        46⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2412
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        47⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1560
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        48⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1116
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        49⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:864
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        50⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2152
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        51⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:544
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        52⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1284
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        53⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1608
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        54⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2800
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        55⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2676
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        56⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1444
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        57⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2120
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        58⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2620
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        59⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3064
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        60⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2624
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        61⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2456
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        62⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1144
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        63⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1904
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        64⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2864
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        65⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2924
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        66⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2880
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        67⤵
        Drops file in System32 directory
        
        PID:1328
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        68⤵
        System Location Discovery: System Language Discovery
        
        PID:2920
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        69⤵
        Drops file in System32 directory
        
        PID:696
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        70⤵
        System Location Discovery: System Language Discovery
        
        PID:2432
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        71⤵
        System Location Discovery: System Language Discovery
        
        PID:2916
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        72⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2516
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        73⤵
        System Location Discovery: System Language Discovery
        
        PID:2220
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        74⤵
        Drops file in System32 directory
        
        PID:2100
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        75⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:872
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        76⤵
        Drops file in System32 directory
        
        PID:1964
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        77⤵
        
        PID:2152
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        78⤵
        Drops file in System32 directory
        
        PID:2176
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        79⤵
        
        PID:2644
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        80⤵
        
        PID:2760
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        81⤵
        
        PID:2748
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        82⤵
        
        PID:2640
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        83⤵
        
        PID:1444
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        84⤵
        
        PID:2120
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        85⤵
        
        PID:2620
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        86⤵
        
        PID:3064
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        87⤵
        
        PID:1376
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        88⤵
        
        PID:1620
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        89⤵
        
        PID:924
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        90⤵
        
        PID:1896
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        91⤵
        
        PID:1960
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        92⤵
        
        PID:2912
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        93⤵
        
        PID:2192
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        94⤵
        
        PID:1328
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        95⤵
        
        PID:2920
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        96⤵
        
        PID:696
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        97⤵
        
        PID:1796
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        98⤵
        
        PID:1568
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        99⤵
        
        PID:2024
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        100⤵
        
        PID:2136
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        101⤵
        
        PID:2512
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        102⤵
        
        PID:2260
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        103⤵
        
        PID:1584
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        104⤵
        
        PID:1680
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        105⤵
        
        PID:2176
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        106⤵
        
        PID:2644
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        107⤵
        
        PID:2760
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        108⤵
        
        PID:2980
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        109⤵
        
        PID:2604
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        110⤵
        
        PID:2720
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        111⤵
        
        PID:2284
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        112⤵
        
        PID:2476
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        113⤵
        
        PID:1128
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        114⤵
        
        PID:1908
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        115⤵
        
        PID:1876
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        116⤵
        
        PID:1880
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        117⤵
        
        PID:1016
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        118⤵
        
        PID:2012
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        119⤵
        
        PID:1772
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        120⤵
        
        PID:1752
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        121⤵
        
        PID:2312
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        122⤵
        
        PID:2020
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        123⤵
        
        PID:956
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        124⤵
        
        PID:1036
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        125⤵
        
        PID:972
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        126⤵
        
        PID:2220
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        127⤵
        
        PID:1624
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        128⤵
        
        PID:868
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        129⤵
        
        PID:1580
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        130⤵
        
        PID:2340
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        131⤵
        
        PID:2384
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        132⤵
        
        PID:2780
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        133⤵
        
        PID:2644
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        134⤵
        
        PID:2788
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        135⤵
        
        PID:2712
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        136⤵
        
        PID:1444
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        137⤵
        
        PID:2604
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        138⤵
        
        PID:2164
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        139⤵
        
        PID:2284
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        140⤵
        
        PID:1120
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        141⤵
        
        PID:1132
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        142⤵
        
        PID:1664
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        143⤵
        
        PID:2960
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        144⤵
        
        PID:2840
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        145⤵
        
        PID:2956
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        146⤵
        
        PID:2144
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        147⤵
        
        PID:2332
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        148⤵
        
        PID:1784
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        149⤵
        
        PID:756
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        150⤵
        
        PID:1980
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        151⤵
        
        PID:2916
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        152⤵
        
        PID:1520
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        153⤵
        
        PID:2632
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        154⤵
        
        PID:1324
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        155⤵
        
        PID:1560
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        156⤵
        
        PID:1856
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        157⤵
        
        PID:2152
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        158⤵
        
        PID:2504
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        159⤵
        
        PID:1964
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        160⤵
        
        PID:1804
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        161⤵
        
        PID:2992
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        162⤵
        
        PID:2824
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        163⤵
        
        PID:2856
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        164⤵
        
        PID:2724
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        165⤵
        
        PID:2664
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        166⤵
        
        PID:3052
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        167⤵
        
        PID:2808
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        168⤵
        
        PID:2624
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        169⤵
        
        PID:2448
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        170⤵
        
        PID:1376
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        171⤵
        
        PID:1896
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        172⤵
        
        PID:2840
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        173⤵
        
        PID:1184
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        174⤵
        
        PID:1072
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        175⤵
        
        PID:2332
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        176⤵
        
        PID:2312
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        177⤵
        
        PID:1340
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        178⤵
        
        PID:1700
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        179⤵
        
        PID:1032
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        180⤵
        
        PID:1568
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        181⤵
        
        PID:2632
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        182⤵
        
        PID:2440
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        183⤵
        
        PID:2100
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        184⤵
        
        PID:2268
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        185⤵
        
        PID:2152
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        186⤵
        
        PID:2504
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        187⤵
        
        PID:1964
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        188⤵
        
        PID:1804
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        189⤵
        
        PID:112
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        190⤵
        
        PID:2172
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        191⤵
        
        PID:2668
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        192⤵
        
        PID:2580
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        193⤵
        
        PID:2564
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        194⤵
        
        PID:2884
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        195⤵
        
        PID:2608
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        196⤵
        
        PID:1120
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        197⤵
        
        PID:1908
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        198⤵
        
        PID:2932
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        199⤵
        
        PID:1676
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        200⤵
        
        PID:2208
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        201⤵
        
        PID:2652
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        202⤵
        
        PID:1020
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        203⤵
        
        PID:2432
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        204⤵
        
        PID:428
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        205⤵
        
        PID:1980
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        206⤵
        
        PID:2920
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        207⤵
        
        PID:2096
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        208⤵
        
        PID:800
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        209⤵
        
        PID:1324
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        210⤵
        
        PID:680
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        211⤵
        
        PID:2260
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        212⤵
        
        PID:1284
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        213⤵
        
        PID:2460
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        214⤵
        
        PID:2504
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        215⤵
        
        PID:2764
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        216⤵
        
        PID:2644
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        217⤵
        
        PID:2584
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        218⤵
        
        PID:2172
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        219⤵
        
        PID:2668
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        220⤵
        
        PID:2164
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        221⤵
        
        PID:1112
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        222⤵
        
        PID:2808
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        223⤵
        
        PID:2888
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        224⤵
        
        PID:1664
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        225⤵
        
        PID:1960
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        226⤵
        
        PID:2952
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        227⤵
        
        PID:2208
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        228⤵
        
        PID:1108
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        229⤵
        
        PID:1496
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        230⤵
        
        PID:2432
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        231⤵
        
        PID:1076
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        232⤵
        
        PID:1700
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        233⤵
        
        PID:2180
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        234⤵
        
        PID:2280
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        235⤵
        
        PID:2024
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        236⤵
        
        PID:1324
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        237⤵
        
        PID:1672
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        238⤵
        
        PID:1580
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        239⤵
        
        PID:2052
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        240⤵
        
        PID:2820
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        241⤵
        
        PID:1964
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        242⤵
        
        PID:2784
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        243⤵
        
        PID:2752
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        244⤵
        
        PID:2576
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        245⤵
        
        PID:2584
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        246⤵
        
        PID:3044
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        247⤵
        
        PID:2564
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        248⤵
        
        PID:3056
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        249⤵
        
        PID:1112
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        250⤵
        
        PID:1872
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        251⤵
        
        PID:1916
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        252⤵
        
        PID:1908
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        253⤵
        
        PID:3032
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        254⤵
        
        PID:1960
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        255⤵
        
        PID:2952
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        256⤵
        
        PID:1072
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        257⤵
        
        PID:392
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        258⤵
        
        PID:1160
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        259⤵
        
        PID:1944
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        260⤵
        
        PID:2916
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        261⤵
        
        PID:2920
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        262⤵
        
        PID:428
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        263⤵
        
        PID:768
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        264⤵
        
        PID:1624
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        265⤵
        
        PID:1440
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        266⤵
        
        PID:2064
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        267⤵
        
        PID:2344
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        268⤵
        
        PID:544
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        269⤵
        
        PID:2408
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        270⤵
        
        PID:2556
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        271⤵
        
        PID:2708
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        272⤵
        
        PID:2644
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        273⤵
        
        PID:3036
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        274⤵
        
        PID:2860
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        275⤵
        
        PID:3060
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        276⤵
        
        PID:1924
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        277⤵
        
        PID:1064
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        278⤵
        
        PID:2356
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        279⤵
        
        PID:1620
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        280⤵
        
        PID:1060
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        281⤵
        
        PID:2372
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        282⤵
        
        PID:1228
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        283⤵
        
        PID:2236
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        284⤵
        
        PID:2208
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        285⤵
        
        PID:628
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        286⤵
        
        PID:1808
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        287⤵
        
        PID:892
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        288⤵
        
        PID:1712
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        289⤵
        
        PID:1548
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        290⤵
        
        PID:880
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        291⤵
        
        PID:768
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        292⤵
        
        PID:1624
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        293⤵
        
        PID:3016
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        294⤵
        
        PID:1856
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        295⤵
        
        PID:2468
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        296⤵
        
        PID:2488
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        297⤵
        
        PID:2276
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        298⤵
        
        PID:2836
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        299⤵
        
        PID:2796
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        300⤵
        
        PID:2712
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        301⤵
        
        PID:2576
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        302⤵
        
        PID:2804
        
        C:\Windows\SysWOW64\agetlktz.exe
        
        "C:\Windows\system32\agetlktz.exe"
        303⤵
        
        PID:3044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\SysWOW64\agetlktz.exe

Filesize
15KB

MD5
d4974a781ecbc5e976d707eb62332c03

SHA1
913a8c25c2dd31d3ba5c45c2818dab7fa189a902

SHA256
4342ad06cc9b14e0c2c6de0edcd9d3af7ccdccc4b11552ba7152be45c80d549c

SHA512
59bb229acf3574b5ae797d5ec7cde8268af62cfbadbf41318a01a77249cd9f885da624092bf452f4408328877d8ff32bf9d214e807c71bb4bbc824cc7368ca72

Download Submit
memory/512-118-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/512-116-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/544-199-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/544-120-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/864-192-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/864-201-0x00000000037D0000-0x00000000037DE000-memory.dmp

Filesize
56KB

Download
memory/864-193-0x00000000037D0000-0x00000000037DE000-memory.dmp

Filesize
56KB

Download
memory/900-112-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/924-73-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/924-79-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1052-105-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1052-183-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1052-181-0x00000000037D0000-0x00000000037DE000-memory.dmp

Filesize
56KB

Download
memory/1060-168-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1060-170-0x0000000003720000-0x000000000372E000-memory.dmp

Filesize
56KB

Download
memory/1060-171-0x0000000003720000-0x000000000372E000-memory.dmp

Filesize
56KB

Download
memory/1060-173-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1060-169-0x0000000003720000-0x0000000003724000-memory.dmp

Filesize
16KB

Download
memory/1072-100-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1116-190-0x00000000037C0000-0x00000000037CE000-memory.dmp

Filesize
56KB

Download
memory/1116-189-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1116-197-0x00000000037C0000-0x00000000037CE000-memory.dmp

Filesize
56KB

Download
memory/1152-167-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1284-200-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1284-204-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1284-203-0x0000000003550000-0x000000000355E000-memory.dmp

Filesize
56KB

Download
memory/1284-122-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1560-187-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1560-109-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1560-110-0x0000000003810000-0x000000000381E000-memory.dmp

Filesize
56KB

Download
memory/1596-127-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1596-125-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1608-205-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1608-207-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1664-149-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1664-151-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1664-152-0x00000000038C0000-0x00000000038CE000-memory.dmp

Filesize
56KB

Download
memory/1664-162-0x00000000038C0000-0x00000000038CE000-memory.dmp

Filesize
56KB

Download
memory/1676-61-0x00000000037D0000-0x00000000037D4000-memory.dmp

Filesize
16KB

Download
memory/1676-65-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1804-4-0x00000000038E0000-0x00000000038E4000-memory.dmp

Filesize
16KB

Download
memory/1804-0-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1804-14-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1804-12-0x00000000038E0000-0x00000000038EE000-memory.dmp

Filesize
56KB

Download
memory/1900-157-0x00000000037C0000-0x00000000037CE000-memory.dmp

Filesize
56KB

Download
memory/1900-158-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1900-159-0x00000000037C0000-0x00000000037CE000-memory.dmp

Filesize
56KB

Download
memory/1900-156-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1932-84-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1944-177-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1944-175-0x0000000003A20000-0x0000000003A2E000-memory.dmp

Filesize
56KB

Download
memory/1944-174-0x0000000003A20000-0x0000000003A24000-memory.dmp

Filesize
16KB

Download
memory/1948-148-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1948-143-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1948-146-0x0000000003790000-0x000000000379E000-memory.dmp

Filesize
56KB

Download
memory/1948-145-0x0000000003790000-0x000000000379E000-memory.dmp

Filesize
56KB

Download
memory/1948-144-0x0000000003790000-0x0000000003794000-memory.dmp

Filesize
16KB

Download
memory/1980-102-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1980-104-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2000-178-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2000-180-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2024-108-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2024-106-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2120-218-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2152-194-0x0000000003810000-0x000000000381E000-memory.dmp

Filesize
56KB

Download
memory/2152-196-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2172-31-0x00000000037D0000-0x00000000037DE000-memory.dmp

Filesize
56KB

Download
memory/2172-30-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2172-24-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2240-131-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2292-153-0x00000000037E0000-0x00000000037EE000-memory.dmp

Filesize
56KB

Download
memory/2292-155-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2296-124-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2312-101-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2372-164-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2408-17-0x0000000003710000-0x0000000003714000-memory.dmp

Filesize
16KB

Download
memory/2408-19-0x0000000003710000-0x000000000371E000-memory.dmp

Filesize
56KB

Download
memory/2408-129-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2408-23-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2412-185-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2424-98-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2424-92-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2448-66-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2448-72-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2528-142-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2568-141-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2624-58-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2688-139-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2700-34-0x00000000036E0000-0x00000000036E4000-memory.dmp

Filesize
16KB

Download
memory/2700-38-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2712-44-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2712-39-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2720-46-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2720-52-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2856-137-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2856-135-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2880-90-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2896-166-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2912-161-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2980-132-0x00000000037C0000-0x00000000037C4000-memory.dmp

Filesize
16KB

Download
memory/2980-134-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2988-113-0x0000000003910000-0x0000000003914000-memory.dmp

Filesize
16KB

Download
memory/2988-115-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download