372c19d5c25a33973f9696d21b4911808c6ba4ebd78c4e0f282b02c52794a495

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09/09/2024, 23:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d74a0e54e92e73969b8d0ceec56ba93f_JaffaCakes118.exe
Size

440KB
MD5

d74a0e54e92e73969b8d0ceec56ba93f
SHA1

e078415f00ede9e6f46bf487e23995825bdf1aa2
SHA256

372c19d5c25a33973f9696d21b4911808c6ba4ebd78c4e0f282b02c52794a495
SHA512

90a3d78dd500676956ff4f30e9c430331645e45a19219cf9b8b43689822ab3855fd4cf4340bc1c72a821867e4231e7c5d669a623edf8300c245b6a1f3ce3bcc2
SSDEEP

12288:n99DPb14ba5BKUtS2yDOveyrNoQZwTaFOGH:nzyu5BKUt3yDKDCdGx

Score

10^/10

discovery evasion

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	tazebama.dl_

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	tazebama.dl_

Executes dropped EXE 64 IoCs

pid	Process
1992	tazebama.dl_
988	tazebama.dl_
2888	tazebama.dl_
2700	tazebama.dl_
2748	tazebama.dl_
2880	tazebama.dl_
2568	tazebama.dl_
1828	tazebama.dl_
2176	tazebama.dl_
1152	tazebama.dl_
2688	tazebama.dl_
1612	tazebama.dl_
1728	tazebama.dl_
1440	tazebama.dl_
2824	tazebama.dl_
112	tazebama.dl_
2772	tazebama.dl_
3068	tazebama.dl_
2728	tazebama.dl_
1976	tazebama.dl_
700	tazebama.dl_
3024	tazebama.dl_
792	tazebama.dl_
2180	tazebama.dl_
1540	tazebama.dl_
2612	tazebama.dl_
2280	tazebama.dl_
592	tazebama.dl_
2236	tazebama.dl_
2768	tazebama.dl_
2836	tazebama.dl_
2188	tazebama.dl_
2296	tazebama.dl_
1948	tazebama.dl_
1616	tazebama.dl_
1484	tazebama.dl_
1684	tazebama.dl_
2348	tazebama.dl_
1732	tazebama.dl_
3112	tazebama.dl_
3160	tazebama.dl_
2036	tazebama.dl_
3208	tazebama.dl_
3256	tazebama.dl_
3304	tazebama.dl_
1324	tazebama.dl_
3352	tazebama.dl_
1220	tazebama.dl_
3400	tazebama.dl_
3448	tazebama.dl_
2656	tazebama.dl_
4064	tazebama.dl_
4016	tazebama.dl_
3964	tazebama.dl_
3916	tazebama.dl_
3868	tazebama.dl_
3820	tazebama.dl_
3772	tazebama.dl_
2900	tazebama.dl_
2400	tazebama.dl_
1692	tazebama.dl_
900	tazebama.dl_
1972	tazebama.dl_
1080	tazebama.dl_

Loads dropped DLL 64 IoCs

pid	Process
2112	d74a0e54e92e73969b8d0ceec56ba93f_JaffaCakes118.exe
2112	d74a0e54e92e73969b8d0ceec56ba93f_JaffaCakes118.exe
2112	d74a0e54e92e73969b8d0ceec56ba93f_JaffaCakes118.exe
2112	d74a0e54e92e73969b8d0ceec56ba93f_JaffaCakes118.exe
2112	d74a0e54e92e73969b8d0ceec56ba93f_JaffaCakes118.exe
2112	d74a0e54e92e73969b8d0ceec56ba93f_JaffaCakes118.exe
2112	d74a0e54e92e73969b8d0ceec56ba93f_JaffaCakes118.exe
2112	d74a0e54e92e73969b8d0ceec56ba93f_JaffaCakes118.exe
2112	d74a0e54e92e73969b8d0ceec56ba93f_JaffaCakes118.exe
2112	d74a0e54e92e73969b8d0ceec56ba93f_JaffaCakes118.exe
2112	d74a0e54e92e73969b8d0ceec56ba93f_JaffaCakes118.exe
2112	d74a0e54e92e73969b8d0ceec56ba93f_JaffaCakes118.exe
2112	d74a0e54e92e73969b8d0ceec56ba93f_JaffaCakes118.exe
2112	d74a0e54e92e73969b8d0ceec56ba93f_JaffaCakes118.exe
2112	d74a0e54e92e73969b8d0ceec56ba93f_JaffaCakes118.exe
2112	d74a0e54e92e73969b8d0ceec56ba93f_JaffaCakes118.exe
2112	d74a0e54e92e73969b8d0ceec56ba93f_JaffaCakes118.exe
2112	d74a0e54e92e73969b8d0ceec56ba93f_JaffaCakes118.exe
2112	d74a0e54e92e73969b8d0ceec56ba93f_JaffaCakes118.exe
2112	d74a0e54e92e73969b8d0ceec56ba93f_JaffaCakes118.exe
2112	d74a0e54e92e73969b8d0ceec56ba93f_JaffaCakes118.exe
2112	d74a0e54e92e73969b8d0ceec56ba93f_JaffaCakes118.exe
2112	d74a0e54e92e73969b8d0ceec56ba93f_JaffaCakes118.exe
2112	d74a0e54e92e73969b8d0ceec56ba93f_JaffaCakes118.exe
2112	d74a0e54e92e73969b8d0ceec56ba93f_JaffaCakes118.exe
2112	d74a0e54e92e73969b8d0ceec56ba93f_JaffaCakes118.exe
2112	d74a0e54e92e73969b8d0ceec56ba93f_JaffaCakes118.exe
2112	d74a0e54e92e73969b8d0ceec56ba93f_JaffaCakes118.exe
2112	d74a0e54e92e73969b8d0ceec56ba93f_JaffaCakes118.exe
2112	d74a0e54e92e73969b8d0ceec56ba93f_JaffaCakes118.exe
2112	d74a0e54e92e73969b8d0ceec56ba93f_JaffaCakes118.exe
2112	d74a0e54e92e73969b8d0ceec56ba93f_JaffaCakes118.exe
2112	d74a0e54e92e73969b8d0ceec56ba93f_JaffaCakes118.exe
2112	d74a0e54e92e73969b8d0ceec56ba93f_JaffaCakes118.exe
2112	d74a0e54e92e73969b8d0ceec56ba93f_JaffaCakes118.exe
2112	d74a0e54e92e73969b8d0ceec56ba93f_JaffaCakes118.exe
2112	d74a0e54e92e73969b8d0ceec56ba93f_JaffaCakes118.exe
2112	d74a0e54e92e73969b8d0ceec56ba93f_JaffaCakes118.exe
2112	d74a0e54e92e73969b8d0ceec56ba93f_JaffaCakes118.exe
2112	d74a0e54e92e73969b8d0ceec56ba93f_JaffaCakes118.exe
2112	d74a0e54e92e73969b8d0ceec56ba93f_JaffaCakes118.exe
2112	d74a0e54e92e73969b8d0ceec56ba93f_JaffaCakes118.exe
2112	d74a0e54e92e73969b8d0ceec56ba93f_JaffaCakes118.exe
2112	d74a0e54e92e73969b8d0ceec56ba93f_JaffaCakes118.exe
2112	d74a0e54e92e73969b8d0ceec56ba93f_JaffaCakes118.exe
2112	d74a0e54e92e73969b8d0ceec56ba93f_JaffaCakes118.exe
2112	d74a0e54e92e73969b8d0ceec56ba93f_JaffaCakes118.exe
2112	d74a0e54e92e73969b8d0ceec56ba93f_JaffaCakes118.exe
2112	d74a0e54e92e73969b8d0ceec56ba93f_JaffaCakes118.exe
2112	d74a0e54e92e73969b8d0ceec56ba93f_JaffaCakes118.exe
2112	d74a0e54e92e73969b8d0ceec56ba93f_JaffaCakes118.exe
2112	d74a0e54e92e73969b8d0ceec56ba93f_JaffaCakes118.exe
2112	d74a0e54e92e73969b8d0ceec56ba93f_JaffaCakes118.exe
2112	d74a0e54e92e73969b8d0ceec56ba93f_JaffaCakes118.exe
2112	d74a0e54e92e73969b8d0ceec56ba93f_JaffaCakes118.exe
2112	d74a0e54e92e73969b8d0ceec56ba93f_JaffaCakes118.exe
2112	d74a0e54e92e73969b8d0ceec56ba93f_JaffaCakes118.exe
2112	d74a0e54e92e73969b8d0ceec56ba93f_JaffaCakes118.exe
2112	d74a0e54e92e73969b8d0ceec56ba93f_JaffaCakes118.exe
2112	d74a0e54e92e73969b8d0ceec56ba93f_JaffaCakes118.exe
2112	d74a0e54e92e73969b8d0ceec56ba93f_JaffaCakes118.exe
2112	d74a0e54e92e73969b8d0ceec56ba93f_JaffaCakes118.exe
2112	d74a0e54e92e73969b8d0ceec56ba93f_JaffaCakes118.exe
2112	d74a0e54e92e73969b8d0ceec56ba93f_JaffaCakes118.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\X:	tazebama.dl_
File opened (read-only)	\??\W:	tazebama.dl_
File opened (read-only)	\??\V:	tazebama.dl_
File opened (read-only)	\??\T:	tazebama.dl_
File opened (read-only)	\??\Q:	tazebama.dl_
File opened (read-only)	\??\M:	tazebama.dl_
File opened (read-only)	\??\E:	tazebama.dl_
File opened (read-only)	\??\N:	tazebama.dl_
File opened (read-only)	\??\L:	tazebama.dl_
File opened (read-only)	\??\J:	tazebama.dl_
File opened (read-only)	\??\Z:	tazebama.dl_
File opened (read-only)	\??\P:	tazebama.dl_
File opened (read-only)	\??\O:	tazebama.dl_
File opened (read-only)	\??\H:	tazebama.dl_
File opened (read-only)	\??\Y:	tazebama.dl_
File opened (read-only)	\??\U:	tazebama.dl_
File opened (read-only)	\??\S:	tazebama.dl_
File opened (read-only)	\??\R:	tazebama.dl_
File opened (read-only)	\??\K:	tazebama.dl_
File opened (read-only)	\??\I:	tazebama.dl_
File opened (read-only)	\??\G:	tazebama.dl_

Drops autorun.inf file 1 TTPs 3 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	F:\autorun.inf	tazebama.dl_
File opened for modification	C:\autorun.inf	tazebama.dl_
File opened for modification	C:\Documents and Settings\Admin\Local Settings\Application Data\Microsoft\CD Burning\autorun.inf	tazebama.dl_

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File opened for modification	C:\PROGRA~2\MICROS~1\OFFICE14\MSPUB.EXE	tazebama.dl_
File opened for modification	C:\PROGRA~2\MICROS~1\OFFICE14\OIS.EXE	tazebama.dl_
File opened for modification	C:\PROGRA~2\MICROS~1\OFFICE14\ONENOTE.EXE	tazebama.dl_
File opened for modification	C:\PROGRA~2\MICROS~1\OFFICE14\OUTLOOK.EXE	tazebama.dl_
File opened for modification	C:\PROGRA~2\MICROS~1\OFFICE14\EXCEL.EXE	tazebama.dl_
File opened for modification	C:\PROGRA~2\MICROS~1\OFFICE14\GROOVE.EXE	tazebama.dl_
File opened for modification	C:\PROGRA~2\MICROS~1\OFFICE14\INFOPATH.EXE	tazebama.dl_
File opened for modification	C:\PROGRA~2\MICROS~1\OFFICE14\MSACCESS.EXE	tazebama.dl_

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2516	4084	WerFault.exe	131

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tazebama.dl_
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d74a0e54e92e73969b8d0ceec56ba93f_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1992	tazebama.dl_
988	tazebama.dl_
988	tazebama.dl_
2888	tazebama.dl_
2888	tazebama.dl_
2700	tazebama.dl_
2700	tazebama.dl_
2748	tazebama.dl_
2748	tazebama.dl_
2880	tazebama.dl_
2880	tazebama.dl_
2568	tazebama.dl_
2568	tazebama.dl_
2176	tazebama.dl_
2176	tazebama.dl_
1828	tazebama.dl_
1828	tazebama.dl_
1152	tazebama.dl_
1152	tazebama.dl_
2688	tazebama.dl_
2688	tazebama.dl_
1612	tazebama.dl_
1612	tazebama.dl_
1440	tazebama.dl_
1440	tazebama.dl_
1728	tazebama.dl_
1728	tazebama.dl_
2824	tazebama.dl_
2824	tazebama.dl_
112	tazebama.dl_
112	tazebama.dl_
2772	tazebama.dl_
2772	tazebama.dl_
2728	tazebama.dl_
2728	tazebama.dl_
3068	tazebama.dl_
3068	tazebama.dl_
1976	tazebama.dl_
700	tazebama.dl_
3024	tazebama.dl_
792	tazebama.dl_
2180	tazebama.dl_
2612	tazebama.dl_
1540	tazebama.dl_
592	tazebama.dl_
2280	tazebama.dl_
2236	tazebama.dl_
2236	tazebama.dl_
2236	tazebama.dl_
2836	tazebama.dl_
2836	tazebama.dl_
2836	tazebama.dl_
2188	tazebama.dl_
2188	tazebama.dl_
2188	tazebama.dl_
2296	tazebama.dl_
2296	tazebama.dl_
2296	tazebama.dl_
2768	tazebama.dl_
2768	tazebama.dl_
2768	tazebama.dl_
1948	tazebama.dl_
1948	tazebama.dl_
1948	tazebama.dl_

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2112 wrote to memory of 1992	2112	d74a0e54e92e73969b8d0ceec56ba93f_JaffaCakes118.exe	30
PID 2112 wrote to memory of 1992	2112	d74a0e54e92e73969b8d0ceec56ba93f_JaffaCakes118.exe	30
PID 2112 wrote to memory of 1992	2112	d74a0e54e92e73969b8d0ceec56ba93f_JaffaCakes118.exe	30
PID 2112 wrote to memory of 1992	2112	d74a0e54e92e73969b8d0ceec56ba93f_JaffaCakes118.exe	30
PID 2112 wrote to memory of 988	2112	d74a0e54e92e73969b8d0ceec56ba93f_JaffaCakes118.exe	31
PID 2112 wrote to memory of 988	2112	d74a0e54e92e73969b8d0ceec56ba93f_JaffaCakes118.exe	31
PID 2112 wrote to memory of 988	2112	d74a0e54e92e73969b8d0ceec56ba93f_JaffaCakes118.exe	31
PID 2112 wrote to memory of 988	2112	d74a0e54e92e73969b8d0ceec56ba93f_JaffaCakes118.exe	31
PID 2112 wrote to memory of 2176	2112	d74a0e54e92e73969b8d0ceec56ba93f_JaffaCakes118.exe	32
PID 2112 wrote to memory of 2176	2112	d74a0e54e92e73969b8d0ceec56ba93f_JaffaCakes118.exe	32
PID 2112 wrote to memory of 2176	2112	d74a0e54e92e73969b8d0ceec56ba93f_JaffaCakes118.exe	32
PID 2112 wrote to memory of 2176	2112	d74a0e54e92e73969b8d0ceec56ba93f_JaffaCakes118.exe	32
PID 2112 wrote to memory of 2888	2112	d74a0e54e92e73969b8d0ceec56ba93f_JaffaCakes118.exe	33
PID 2112 wrote to memory of 2888	2112	d74a0e54e92e73969b8d0ceec56ba93f_JaffaCakes118.exe	33
PID 2112 wrote to memory of 2888	2112	d74a0e54e92e73969b8d0ceec56ba93f_JaffaCakes118.exe	33
PID 2112 wrote to memory of 2888	2112	d74a0e54e92e73969b8d0ceec56ba93f_JaffaCakes118.exe	33
PID 2112 wrote to memory of 2688	2112	d74a0e54e92e73969b8d0ceec56ba93f_JaffaCakes118.exe	34
PID 2112 wrote to memory of 2688	2112	d74a0e54e92e73969b8d0ceec56ba93f_JaffaCakes118.exe	34
PID 2112 wrote to memory of 2688	2112	d74a0e54e92e73969b8d0ceec56ba93f_JaffaCakes118.exe	34
PID 2112 wrote to memory of 2688	2112	d74a0e54e92e73969b8d0ceec56ba93f_JaffaCakes118.exe	34
PID 2112 wrote to memory of 2700	2112	d74a0e54e92e73969b8d0ceec56ba93f_JaffaCakes118.exe	35
PID 2112 wrote to memory of 2700	2112	d74a0e54e92e73969b8d0ceec56ba93f_JaffaCakes118.exe	35
PID 2112 wrote to memory of 2700	2112	d74a0e54e92e73969b8d0ceec56ba93f_JaffaCakes118.exe	35
PID 2112 wrote to memory of 2700	2112	d74a0e54e92e73969b8d0ceec56ba93f_JaffaCakes118.exe	35
PID 2112 wrote to memory of 2824	2112	d74a0e54e92e73969b8d0ceec56ba93f_JaffaCakes118.exe	36
PID 2112 wrote to memory of 2824	2112	d74a0e54e92e73969b8d0ceec56ba93f_JaffaCakes118.exe	36
PID 2112 wrote to memory of 2824	2112	d74a0e54e92e73969b8d0ceec56ba93f_JaffaCakes118.exe	36
PID 2112 wrote to memory of 2824	2112	d74a0e54e92e73969b8d0ceec56ba93f_JaffaCakes118.exe	36
PID 2112 wrote to memory of 2748	2112	d74a0e54e92e73969b8d0ceec56ba93f_JaffaCakes118.exe	37
PID 2112 wrote to memory of 2748	2112	d74a0e54e92e73969b8d0ceec56ba93f_JaffaCakes118.exe	37
PID 2112 wrote to memory of 2748	2112	d74a0e54e92e73969b8d0ceec56ba93f_JaffaCakes118.exe	37
PID 2112 wrote to memory of 2748	2112	d74a0e54e92e73969b8d0ceec56ba93f_JaffaCakes118.exe	37
PID 2112 wrote to memory of 2728	2112	d74a0e54e92e73969b8d0ceec56ba93f_JaffaCakes118.exe	38
PID 2112 wrote to memory of 2728	2112	d74a0e54e92e73969b8d0ceec56ba93f_JaffaCakes118.exe	38
PID 2112 wrote to memory of 2728	2112	d74a0e54e92e73969b8d0ceec56ba93f_JaffaCakes118.exe	38
PID 2112 wrote to memory of 2728	2112	d74a0e54e92e73969b8d0ceec56ba93f_JaffaCakes118.exe	38
PID 2112 wrote to memory of 2880	2112	d74a0e54e92e73969b8d0ceec56ba93f_JaffaCakes118.exe	39
PID 2112 wrote to memory of 2880	2112	d74a0e54e92e73969b8d0ceec56ba93f_JaffaCakes118.exe	39
PID 2112 wrote to memory of 2880	2112	d74a0e54e92e73969b8d0ceec56ba93f_JaffaCakes118.exe	39
PID 2112 wrote to memory of 2880	2112	d74a0e54e92e73969b8d0ceec56ba93f_JaffaCakes118.exe	39
PID 2112 wrote to memory of 3024	2112	d74a0e54e92e73969b8d0ceec56ba93f_JaffaCakes118.exe	40
PID 2112 wrote to memory of 3024	2112	d74a0e54e92e73969b8d0ceec56ba93f_JaffaCakes118.exe	40
PID 2112 wrote to memory of 3024	2112	d74a0e54e92e73969b8d0ceec56ba93f_JaffaCakes118.exe	40
PID 2112 wrote to memory of 3024	2112	d74a0e54e92e73969b8d0ceec56ba93f_JaffaCakes118.exe	40
PID 2112 wrote to memory of 2568	2112	d74a0e54e92e73969b8d0ceec56ba93f_JaffaCakes118.exe	41
PID 2112 wrote to memory of 2568	2112	d74a0e54e92e73969b8d0ceec56ba93f_JaffaCakes118.exe	41
PID 2112 wrote to memory of 2568	2112	d74a0e54e92e73969b8d0ceec56ba93f_JaffaCakes118.exe	41
PID 2112 wrote to memory of 2568	2112	d74a0e54e92e73969b8d0ceec56ba93f_JaffaCakes118.exe	41
PID 2112 wrote to memory of 2612	2112	d74a0e54e92e73969b8d0ceec56ba93f_JaffaCakes118.exe	42
PID 2112 wrote to memory of 2612	2112	d74a0e54e92e73969b8d0ceec56ba93f_JaffaCakes118.exe	42
PID 2112 wrote to memory of 2612	2112	d74a0e54e92e73969b8d0ceec56ba93f_JaffaCakes118.exe	42
PID 2112 wrote to memory of 2612	2112	d74a0e54e92e73969b8d0ceec56ba93f_JaffaCakes118.exe	42
PID 2112 wrote to memory of 1828	2112	d74a0e54e92e73969b8d0ceec56ba93f_JaffaCakes118.exe	43
PID 2112 wrote to memory of 1828	2112	d74a0e54e92e73969b8d0ceec56ba93f_JaffaCakes118.exe	43
PID 2112 wrote to memory of 1828	2112	d74a0e54e92e73969b8d0ceec56ba93f_JaffaCakes118.exe	43
PID 2112 wrote to memory of 1828	2112	d74a0e54e92e73969b8d0ceec56ba93f_JaffaCakes118.exe	43
PID 2112 wrote to memory of 2296	2112	d74a0e54e92e73969b8d0ceec56ba93f_JaffaCakes118.exe	44
PID 2112 wrote to memory of 2296	2112	d74a0e54e92e73969b8d0ceec56ba93f_JaffaCakes118.exe	44
PID 2112 wrote to memory of 2296	2112	d74a0e54e92e73969b8d0ceec56ba93f_JaffaCakes118.exe	44
PID 2112 wrote to memory of 2296	2112	d74a0e54e92e73969b8d0ceec56ba93f_JaffaCakes118.exe	44
PID 2112 wrote to memory of 1152	2112	d74a0e54e92e73969b8d0ceec56ba93f_JaffaCakes118.exe	45
PID 2112 wrote to memory of 1152	2112	d74a0e54e92e73969b8d0ceec56ba93f_JaffaCakes118.exe	45
PID 2112 wrote to memory of 1152	2112	d74a0e54e92e73969b8d0ceec56ba93f_JaffaCakes118.exe	45
PID 2112 wrote to memory of 1152	2112	d74a0e54e92e73969b8d0ceec56ba93f_JaffaCakes118.exe	45

C:\Users\Admin\AppData\Local\Temp\d74a0e54e92e73969b8d0ceec56ba93f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d74a0e54e92e73969b8d0ceec56ba93f_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2112
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:1992
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:988
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2176
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2888
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2688
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2700
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2824
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2748
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2728
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2880
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:3024
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2568
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2612
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:1828
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2296
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:1152
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  PID:1484
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:1612
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  PID:1732
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:1728
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  PID:2036
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:1440
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  PID:1324
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:112
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  PID:1220
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2772
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:3068
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3052
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:1976
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:316
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:700
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  PID:1080
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:792
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  PID:1972
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2180
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  PID:900
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:1540
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  PID:1692
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2236
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  PID:2400
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:592
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2280
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2800
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2768
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2892
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2836
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2624
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2188
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:980
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:1948
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:300
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  PID:1616
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:1944
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  PID:1684
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:1724
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  PID:2348
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3088
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  PID:3112
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3136
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  PID:3160
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3184
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  PID:3208
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3232
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  PID:3256
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3280
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  PID:3304
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3328
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  PID:3352
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3376
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  PID:3400
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3424
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  PID:3448
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3472
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  PID:3772
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3796
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  PID:3820
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3844
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  PID:3868
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3892
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  PID:3916
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3940
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  PID:3964
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3988
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  PID:4016
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4040
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Executes dropped EXE
  PID:4064
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4088
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2716
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2432
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2684
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:1424
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2124
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:1588
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3128
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3216
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3272
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3360
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3416
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3792
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Enumerates connected drives
  - Drops autorun.inf file
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:4084
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4084 -s 320
    3⤵
    - Program crash
    PID:2516
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:1764
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3884
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3036
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:1652
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3156
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3300
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3444
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3816
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3912
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4060
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3832
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2064
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2528
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:780
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2212
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:992
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2784
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2440
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2592
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:1932
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2232
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4056
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3956
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2532
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:892
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3860
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2120
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3808
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3480
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3392
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3340
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3288
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3200
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3144
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:468
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:1620
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:1872
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3512
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2896
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2060
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3712
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3724
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3748
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3764
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2804
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2712
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2184
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:1772
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:1876
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2956
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2820
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:1552
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2468
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2920
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3060
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2444
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:1252
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2808
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3412
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2964
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2240
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2100
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:320
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:1572
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3168
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3312
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3468
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:1780
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2664
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3228
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3372
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:1596
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2628
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:1344
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2028
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:1288
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2128
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:1340
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2960
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4076
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4032
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3972
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2852
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3836
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:1380
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3012
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3056
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:1924
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4100
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4348
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4360
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4372
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4384
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4396
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4408
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4420
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4432
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4444
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4456
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4468
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4480
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4492
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4504
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4516
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4528
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4540
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4552
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4564
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4576
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4588
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4600
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4612
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4624
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4636
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4648
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4660
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4672
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4820
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4836
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4848
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4868
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4880
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4900
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4912
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4924
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4936
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4948
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4960
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4972
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4984
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4996
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:5008
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:5020
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:5032
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:5044
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:5056
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:5068
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:5080
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:5092
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:5104
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:5116
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3852
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3484
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3244
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3240
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2300
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3708
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3176
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2876
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2316
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:1628
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2600
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:1196
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:1820
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2596
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2140
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4080
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:1028
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3784
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4028
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:1392
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2812
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3876
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:1536
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:1300
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4000
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3904
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2424
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4116
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4128
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4140
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4152
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:1032
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3780
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:1756
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3812
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3296
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3152
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:1132
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:1216
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:952
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3720
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3756
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2756
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:108
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2480
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:1428
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:1984
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3268
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:1228
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:1868
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3420
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:1744
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2032
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:1804
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4184
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4196
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4224
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4212
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4232
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4244
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4256
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4268
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4280
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4292
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4304
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4316
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4328
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4340
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4392
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4464
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4536
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4608
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4356
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4428
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4500
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4572
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4644
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4688
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4700
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4752
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4760
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4780
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4792
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4804
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4816
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4844
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4864
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4892
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4932
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:5004
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:5076
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3384
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4944
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4992
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:5064
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:1020
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:1600
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:796
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2452
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3224
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3984
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:1624
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2792
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3324
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:1504
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4108
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:960
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4124
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:840
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2504
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:1792
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4160
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3908
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:1336
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:3368
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:2708
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4192
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:444
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4220
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4680
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4584
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4336
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4264
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4812
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4860
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4740
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4476
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4620
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:4300
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:5132
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:5144
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:5156
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:5168
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:5180
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:5192
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:5204
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:5216
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:5228
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:5240
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:5252
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:5264
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:5276
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:5288
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:5300
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:5312
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:5324
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:5336
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:5348
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:5360
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:5372
- C:\Documents and Settings\tazebama.dl_
  "C:\Documents and Settings\tazebama.dl_"
  2⤵
  PID:5384

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\autorun.inf

Filesize
126B

MD5
163e20cbccefcdd42f46e43a94173c46

SHA1
4c7b5048e8608e2a75799e00ecf1bbb4773279ae

SHA256
7780bee9df142a17e0457f3dcb2788b50fc2792370089335597d33719126fb7e

SHA512
e5ac0ff6b087857799ab70f68067c9dc73eeb93ccfcad87047052380b95ade3e6eb2a7d01a0f850d548a39f4b1ebb60e299d603dbe25c31b9a3585b34a0c65a8

Download Submit
C:\zPharaoh.exe

Filesize
157KB

MD5
e40fa6d6c93e3612d76cd9e02cedbb50

SHA1
bf823b9b020ccbd040e5bc7d7be45fb9791e8d27

SHA256
fe8e15c3c3b78a5486a4ed85060d50966060834960bbdb2eba7906414842912c

SHA512
c6ea56787d37da65853a93cbe19ca4ba61105d105ec43a08299a32cec406ea859828308ce6ec39cbc44abb118f42d678465bb09d58b274cdbf937a35add018d0

Download Submit
F:\zPharaoh.exe

Filesize
158KB

MD5
2c9fd60cd72a65873cb9301d1b0ad6e1

SHA1
a6186cab2538bab3013529267cf2fa48c6106d29

SHA256
6929c9de3d6906521fdbf8570c1efdf7c9e511418862b2c26002b3d200bc1208

SHA512
0721a8d5fc2eb05c5c45fcf30934d0194968ae7a0ba9c32eda57fb92f3b54119d886331ba63c0d158a850ba38d1711c7cdd0fcea3c874dc4ea14fb2d6136a2ab

Download Submit
\Users\tazebama.dl_

Filesize
157KB

MD5
7ad28b3622198870b43e50fc9893e5b0

SHA1
a3ab1fd83de96c2ebf1138c974ea1736dd04d1fe

SHA256
21455555e3654c57c0fddd872945cba78920dd59bdc1b5845679258e05ef065a

SHA512
a029af858d33f22ad1fe00c95fdbc61c5398ebeacce4f3336bd01e34f50218e2a42d36e01abaf5b94c7278ae1e4965185b84b59ccbfa74f59e9bbab08cece5dd

Download Submit
\Users\tazebama.dll

Filesize
32KB

MD5
b6a03576e595afacb37ada2f1d5a0529

SHA1
d598d4d0e70dec2ffa2849edaeb4db94fedcc0b8

SHA256
1707eaf60aa91f3791aa5643bfa038e9d8141878d61f5d701ebac51f4ae7aaad

SHA512
181b7cc6479352fe2c53c3630d45a839cdeb74708be6709c2a75847a54de3ffc1fdac8450270dde7174ecb23e5cb002f8ce39032429a3112b1202f3381b8918c

Download Submit
memory/112-266-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/300-517-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/592-285-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/700-271-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/792-273-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/988-252-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/1152-260-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/1220-421-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/1324-418-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/1440-263-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/1484-408-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/1540-280-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/1612-262-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/1616-409-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/1684-410-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/1728-264-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/1732-412-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/1948-407-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/1976-270-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/1992-193-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2036-415-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2112-491-0x0000000000260000-0x0000000000278000-memory.dmp

Filesize
96KB

Download
memory/2112-488-0x0000000000260000-0x0000000000278000-memory.dmp

Filesize
96KB

Download
memory/2112-215-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/2112-209-0x0000000000260000-0x0000000000278000-memory.dmp

Filesize
96KB

Download
memory/2112-196-0x0000000000402000-0x000000000040E000-memory.dmp

Filesize
48KB

Download
memory/2112-127-0x0000000000260000-0x0000000000278000-memory.dmp

Filesize
96KB

Download
memory/2112-563-0x0000000000260000-0x0000000000278000-memory.dmp

Filesize
96KB

Download
memory/2112-564-0x0000000000260000-0x0000000000278000-memory.dmp

Filesize
96KB

Download
memory/2112-565-0x0000000000260000-0x0000000000278000-memory.dmp

Filesize
96KB

Download
memory/2112-566-0x0000000000260000-0x0000000000278000-memory.dmp

Filesize
96KB

Download
memory/2112-567-0x0000000000260000-0x0000000000278000-memory.dmp

Filesize
96KB

Download
memory/2112-512-0x0000000000260000-0x0000000000278000-memory.dmp

Filesize
96KB

Download
memory/2112-482-0x0000000000260000-0x0000000000278000-memory.dmp

Filesize
96KB

Download
memory/2112-483-0x0000000000260000-0x0000000000278000-memory.dmp

Filesize
96KB

Download
memory/2112-484-0x0000000000260000-0x0000000000278000-memory.dmp

Filesize
96KB

Download
memory/2112-485-0x0000000000260000-0x0000000000278000-memory.dmp

Filesize
96KB

Download
memory/2112-486-0x0000000000260000-0x0000000000278000-memory.dmp

Filesize
96KB

Download
memory/2112-487-0x0000000000260000-0x0000000000278000-memory.dmp

Filesize
96KB

Download
memory/2112-253-0x0000000000260000-0x0000000000278000-memory.dmp

Filesize
96KB

Download
memory/2112-489-0x0000000000260000-0x0000000000278000-memory.dmp

Filesize
96KB

Download
memory/2112-490-0x0000000000260000-0x0000000000278000-memory.dmp

Filesize
96KB

Download
memory/2112-167-0x0000000000260000-0x0000000000278000-memory.dmp

Filesize
96KB

Download
memory/2112-201-0x0000000000260000-0x0000000000278000-memory.dmp

Filesize
96KB

Download
memory/2112-0-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/2112-492-0x0000000000260000-0x0000000000278000-memory.dmp

Filesize
96KB

Download
memory/2112-493-0x0000000000260000-0x0000000000278000-memory.dmp

Filesize
96KB

Download
memory/2112-494-0x0000000000260000-0x0000000000278000-memory.dmp

Filesize
96KB

Download
memory/2112-495-0x0000000000260000-0x0000000000278000-memory.dmp

Filesize
96KB

Download
memory/2112-496-0x0000000000260000-0x0000000000278000-memory.dmp

Filesize
96KB

Download
memory/2112-497-0x0000000000260000-0x0000000000278000-memory.dmp

Filesize
96KB

Download
memory/2112-498-0x0000000000260000-0x0000000000278000-memory.dmp

Filesize
96KB

Download
memory/2112-499-0x0000000000260000-0x0000000000278000-memory.dmp

Filesize
96KB

Download
memory/2112-500-0x0000000000260000-0x0000000000278000-memory.dmp

Filesize
96KB

Download
memory/2112-501-0x0000000000260000-0x0000000000278000-memory.dmp

Filesize
96KB

Download
memory/2112-502-0x0000000000260000-0x0000000000278000-memory.dmp

Filesize
96KB

Download
memory/2112-503-0x0000000000260000-0x0000000000278000-memory.dmp

Filesize
96KB

Download
memory/2176-259-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2180-274-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2188-406-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2236-402-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2280-286-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2296-404-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2348-411-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2568-258-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2612-275-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2656-481-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2688-261-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2700-255-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2728-268-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2748-256-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2768-405-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2772-267-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2824-265-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2836-403-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2880-257-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2888-254-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/3024-272-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/3068-269-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/3088-515-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/3112-413-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/3136-514-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/3160-414-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/3208-416-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/3232-513-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/3256-417-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/3304-419-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/3352-420-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/3400-422-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/3448-460-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/3772-509-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/3820-508-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/3868-507-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/3964-506-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/4016-505-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/4064-504-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download