ardamax | 6b1700a3961f46120afdf3c5e027556682badcae0015503d533c9f808f214ddc

Resubmissions

22-09-2024 11:21

240922-nf3exaxbrf 7

19-09-2024 15:20

240919-sqqajsvgnf 7

19-09-2024 13:36

240919-qv9tms1gqm 10

Analysis

max time kernel
31s
max time network
107s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19-09-2024 13:36

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

RatAlerts.exe
Size

36.7MB
MD5

f921e16ca321bbe2e490f036f8b99c74
SHA1

6e25638b340ba77f3e467bbbdc27c48209e193af
SHA256

6b1700a3961f46120afdf3c5e027556682badcae0015503d533c9f808f214ddc
SHA512

04492839ccaeeddc9090b7f6c6458294540bb3e2589108a3c459ae87a11c6cabe6548d80805f37b8bd43616d3645afdabe8b95b9f37c85c06f5c87b137a10274
SSDEEP

786432:pjE3Qtst8rW8WZ2YwUlJAdQ/2j6+s7LWB75zuXVgM3MGYS2fAMJLjvZ:a3QtIoWlZ2mlq62qHWB75ilZMGJ24MRN

Malware Config

Extracted

Family

berbew

http://crutop.nu/index.php

http://crutop.ru/index.php

http://mazafaka.ru/index.php

http://color-bank.ru/index.php

http://asechka.ru/index.php

http://trojan.ru/index.php

http://fuck.ru/index.php

http://goldensand.ru/index.php

http://filesearch.ru/index.php

http://devx.nm.ru/index.php

http://ros-neftbank.ru/index.php

http://lovingod.host.sk/index.php

http://www.redline.ru/index.php

http://cvv.ru/index.php

http://hackers.lv/index.php

http://fethard.biz/index.php

http://ldark.nm.ru/index.htm

http://gaz-prom.ru/index.htm

http://promo.ru/index.htm

http://potleaf.chat.ru/index.htm

Extracted

Family

cybergate

Version

2.7 Beta 02

Botnet

soso

xsasax.no-ip.info:88

Mutex

***MUTEX***

Attributes

enable_keylogger
true
enable_message_box
false
ftp_directory
./logs/
ftp_interval
30
injected_process
svchost.exe
install_dir
windows
install_file
windows-help.exe
install_flag
true
keylogger_enable_ftp
false
message_box_caption
texto da mensagem
message_box_title
título da mensagem
password
1111
regkey_hkcu
windows-dif
regkey_hklm
windows

Extracted

Family

xworm

127.0.0.1:14624

button-temp.gl.at.ply.gg:14624

Attributes

Install_directory
%AppData%
install_file
USB.exe

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dkndie32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Edbiniff.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Keifdpif.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kidben32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fkofga32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hlblcn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hlblcn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ekcgkb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fnbcgn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	240919-qkh8ya1cmm_bc3d5d77e96f00f8558719d43dbd24274073169093539acd5acc78a9dab3941aN.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dkcndeen.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dnajppda.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Egohdegl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Edbiniff.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ekcgkb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fbmohmoh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fbplml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Filapfbo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	240919-qs2p9a1bka_851f998612344631b54cc755cd168508036121ed3cc0060e94af5d0c3c85ba7fN.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dahmfpap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	240919-qj3aeszfkg_75c6406f46645aba1afbeba7402c51bbfcb81d6536780637bb621e55c34a2b15N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	240919-qscq5a1aqd_6c414fba6f89bca0e6ad7bd4b4fb161d7d3a758a66fe6cdd826656cbb5e6fa54N.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	240919-qbdl4azgrr_6de440eec5ab0e04b83f6501d2efd4b4c52f57f41fb3c9f06d9b0afd960c6021N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	240919-qaah2szbqg_bf16782f1bb5625296e22bb444aac8d330b03cdfc73f4e8d0a22e9daf77cbf40N.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kocgbend.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fnfmbmbi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kiphjo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kocgbend.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	240919-p81bpazfrj_72369386d9596ace4950517c7ef51e300c59cac1cf9c46c0fb9ff95a4a9f51dbN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	240919-qkh8ya1cmm_bc3d5d77e96f00f8558719d43dbd24274073169093539acd5acc78a9dab3941aN.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddnobj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Edionhpn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	240919-p8wnhazfqn_80ebb66a5b76ab87390005861b0b534bb838752540188face72be2a2f1364803N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	240919-qdam8azhpq_6ed813417e50cef43ce169bf8e48fd96e69ef00b4a32288729a3b25ecfcbed30N.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	240919-p89v5azbmd_0bec6a5d23ec34155a4a5b5c4ae3dcd99e70415da6922b5cfc6aca06fac442bdN.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Geoapenf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lhcali32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dhgonidg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ekjded32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ekajec32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fqgedh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fbplml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dnonkq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dqpfmlce.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Eqiibjlj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Enpfan32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fndpmndl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fnfmbmbi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dnajppda.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ebdlangb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	240919-qscq5a1aqd_6c414fba6f89bca0e6ad7bd4b4fb161d7d3a758a66fe6cdd826656cbb5e6fa54N.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Enpfan32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dqpfmlce.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ebdlangb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fniihmpf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	240919-qaah2szbqg_bf16782f1bb5625296e22bb444aac8d330b03cdfc73f4e8d0a22e9daf77cbf40N.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kcoccc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	240919-p81bpazfrj_72369386d9596ace4950517c7ef51e300c59cac1cf9c46c0fb9ff95a4a9f51dbN.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	240919-qj3aeszfkg_75c6406f46645aba1afbeba7402c51bbfcb81d6536780637bb621e55c34a2b15N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ekajec32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ehpadhll.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Foclgq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Klndfj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	240919-qt4k8s1glq_19dab265f48a2fc83ee2411287d5509106326c5c8ffa74cb5befdc5f01b38dc9N.exe

Ardamax
A keylogger first seen in 2013.
keylogger stealer ardamax

Ardamax main executable 1 IoCs

resource	yara_rule
behavioral1/files/0x0007000000023947-1584.dat	family_ardamax

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
CyberGate, Rebhip
CyberGate is a lightweight remote administration tool with a wide array of functionalities.
trojan stealer cybergate
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral1/memory/4296-1220-0x00000000001F0000-0x0000000000208000-memory.dmp	family_xworm

Detects MyDoom family 3 IoCs

resource	yara_rule
behavioral1/memory/4332-1114-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral1/memory/4468-1365-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral1/memory/4332-1232-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom

Disables service(s) 3 TTPs
evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Modifies firewall policy service 3 TTPs 5 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	240919-qkjvga1cmn_eb69e5c48d13d4a1b33ca72ac6500830_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	240919-qkjvga1cmn_eb69e5c48d13d4a1b33ca72ac6500830_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	240919-qkjvga1cmn_eb69e5c48d13d4a1b33ca72ac6500830_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\	240919-qkjvga1cmn_eb69e5c48d13d4a1b33ca72ac6500830_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\Downloads\240919-qkjvga1cmn_eb69e5c48d13d4a1b33ca72ac6500830_JaffaCakes118.exe = "C:\\Users\\Admin\\Downloads\\240919-qkjvga1cmn_eb69e5c48d13d4a1b33ca72ac6500830_JaffaCakes118.exe:*:Enabled:csrss"	240919-qkjvga1cmn_eb69e5c48d13d4a1b33ca72ac6500830_JaffaCakes118.exe

Modifies visibility of file extensions in Explorer 2 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	240919-qkmw5azfnb_Trojan.Win32.Vilsel.pz1ed26b1a1d6b36f43a2250b898323ff1b7de4e6aae213bedbaca2f96c5d8b11bN
Set value (int)	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	240919-qcycwszdja_0f2303b912c2e4071f4fb9e9703c53e7756ab3246dca03f2329304c1c58cd1c2N.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	240919-qktpnszfnh_44c2bc170fd3a4981a56fccdc449ad90b646b0d71c1793824fcfe28f36aea697N.exe

MyDoom
MyDoom is a Worm that is written in C++.
worm mydoom

Process spawned unexpected child process 47 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	15252	18100	schtasks.exe	1046
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1784	18100	schtasks.exe	1046
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5280	18100	schtasks.exe	1046
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	16644	18100	Process not Found	1046
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	14828	18100	schtasks.exe	1046
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1084	18100	Process not Found	1046
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	8212	18100	Process not Found	1046
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4604	18100	Process not Found	1046
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	10496	18100	Process not Found	1046
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	10504	18100	Process not Found	1046
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4348	18100	Process not Found	1046
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	18584	18100	Process not Found	1046
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	14248	18100	Process not Found	1046
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2064	18100	Process not Found	1046
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	12068	18100	Process not Found	1046
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	9672	18100	Process not Found	1046
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	11916	18100	Process not Found	1046
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	14176	18100	Process not Found	1046
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	15236	18100	Process not Found	1046
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	18292	18100	Process not Found	1046
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	11380	18100	Process not Found	1046
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	10756	18100	Process not Found	1046
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	14480	18100	Process not Found	1046
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	12084	18100	Process not Found	1046
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	18624	18100	Process not Found	1046
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1356	18100	Process not Found	1046
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	9848	18100	Process not Found	1046
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	14800	18100	Process not Found	1046
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4976	18100	Process not Found	1046
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	13372	18100	Process not Found	1046
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	12560	18100	Process not Found	1046
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	13300	18100	Process not Found	1046
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2472	18100	Process not Found	1046
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	964	18100	Process not Found	1046
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	19108	18100	Process not Found	1046
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2256	18100	Process not Found	1046
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	15860	18100	Process not Found	1046
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	18348	18100	Process not Found	1046
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	17956	18100	Process not Found	1046
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	16908	18100	Process not Found	1046
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1356	18100	Process not Found	1046
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	13292	18100	Process not Found	1046
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	19044	18100	Process not Found	1046
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2180	18100	Process not Found	1046
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1604	18100	Process not Found	1046
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	18804	18100	Process not Found	1046
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	9780	18100	Process not Found	1046

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	240919-qb91aszcpe_eb64dbb7b99cbfe581497232b6c09832_JaffaCakes118.exe

Windows security bypass 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UACDisableNotify = "0"	240919-qb91aszcpe_eb64dbb7b99cbfe581497232b6c09832_JaffaCakes118.exe

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

DCRat payload 1 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x0009000000024073-7008.dat	dcrat

XMRig Miner payload 2 IoCs

miner

resource	yara_rule
behavioral1/memory/5756-1757-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral1/files/0x0007000000023a1f-2113.dat	xmrig

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\windefender = "C:\\Windows\\windows\\windows-help.exe"	240919-qskrqs1are_eb6f29af0991d001e0f39f6b062810b4_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	240919-qskrqs1are_eb6f29af0991d001e0f39f6b062810b4_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\windefender = "C:\\Windows\\windows\\windows-help.exe"	240919-qskrqs1are_eb6f29af0991d001e0f39f6b062810b4_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	240919-qskrqs1are_eb6f29af0991d001e0f39f6b062810b4_JaffaCakes118.exe

Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{C03MR0L4-Q58Y-70R0-07NX-6561G5NQ5C6V}	240919-qskrqs1are_eb6f29af0991d001e0f39f6b062810b4_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C03MR0L4-Q58Y-70R0-07NX-6561G5NQ5C6V}\StubPath = "C:\\Windows\\windows\\windows-help.exe Restart"	240919-qskrqs1are_eb6f29af0991d001e0f39f6b062810b4_JaffaCakes118.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation	240919-p9gwqszbnd_eb631d5e7add23a6dc50e841a8c98c88_JaffaCakes118.exe

Executes dropped EXE 64 IoCs

pid	Process
2128	240919-qkmw5azfnb_Trojan.Win32.Vilsel.pz1ed26b1a1d6b36f43a2250b898323ff1b7de4e6aae213bedbaca2f96c5d8b11bN
352	240919-qs2p9a1bka_851f998612344631b54cc755cd168508036121ed3cc0060e94af5d0c3c85ba7fN.exe
1660	Dddllkbf.exe
2564	Dkndie32.exe
4000	Dahmfpap.exe
2396	Dgeenfog.exe
4332	240919-qkp2gs1cnm_643eaa5505d3d177fcef92d75b88904409f2d52224072ea4e9cd7afb19bd4055N.exe
1056	Dnonkq32.exe
3056	240919-qkjvga1cmn_eb69e5c48d13d4a1b33ca72ac6500830_JaffaCakes118.exe
4320	services.exe
2932	240919-qj83za1clq_8b071f6d72e774adb139f7408782446f133708591f33d0002e479d9e66fe6eb3N.exe
2008	240919-qkh8ya1cmm_bc3d5d77e96f00f8558719d43dbd24274073169093539acd5acc78a9dab3941aN.exe
4528	Dkcndeen.exe
4820	Dnajppda.exe
4020	240919-qjs2ra1ckl_0b9d0b09198f282ce44c2dd86ecce550c4c63e99efe9bb3ab2f3e34ee7da29c9N.exe
1060	240919-qc8hvszdjf_b826a05ea57336b45c502e7b917a4976304f7b5ce65f63f82f97111811d68d90N.exe
4756	Dhgonidg.exe
4296	240919-qbmvrszcmb_DetestationPaidSpoofer.exe
3816	Dkekjdck.exe
2468	Dqpfmlce.exe
4452	Ddnobj32.exe
3800	Dglkoeio.exe
2432	Enfckp32.exe
2772	Edplhjhi.exe
4516	Egohdegl.exe
4160	240919-qczkyszhnp_eb655f9a969019a6e01f3480e77344ba_JaffaCakes118.exe
3828	Ekjded32.exe
1080	Enhpao32.exe
5048	Ebdlangb.exe
696	Edbiniff.exe
2464	240919-qkk3jazfmh_Backdoor.Win32.Berbew.AA.MTB-35f1edad02c11ad69e15e9cb5eacff172fcd54cb25649d62bd5f7875906f6b7cN
1880	240919-p9mf8azgkm_60b9d964ccf958454decab62bcb12b3479ffef67241c36e4b3d93e51c2c212a2N.exe
4612	240919-qrwsls1flr_2024-09-19_c526aa84bc26278f2f156a34fbe00a83_virlock.exe
4800	240919-qscq5a1aqd_6c414fba6f89bca0e6ad7bd4b4fb161d7d3a758a66fe6cdd826656cbb5e6fa54N.exe
4484	240919-qj3aeszfkg_75c6406f46645aba1afbeba7402c51bbfcb81d6536780637bb621e55c34a2b15N.exe
1696	Eqiibjlj.exe
1296	Eqiibjlj.exe
4808	240919-p9gwqszbnd_eb631d5e7add23a6dc50e841a8c98c88_JaffaCakes118.exe
4548	Enmjlojd.exe
2856	Ekajec32.exe
4432	Ehpadhll.exe
2828	Ehbnigjj.exe
5212	Edionhpn.exe
5224	240919-p8wnhazfqn_80ebb66a5b76ab87390005861b0b534bb838752540188face72be2a2f1364803N.exe
5232	240919-p94eqszgml_48ab527e06366a4e12e140d509afa43cd887cfcf1d9173ffe357441e30bc90f2N.exe
4468	240919-qnzp4azgra_Worm.Win32.Mydoom.pz5851085fd7c81bbd629d3145500cbbea1d499b80a044b5f1f2a736f66d0dd69bN
5268	Eiekog32.exe
3316	Enpfan32.exe
5328	Ekcgkb32.exe
5340	Ekcgkb32.exe
5356	240919-qbdl4azgrr_6de440eec5ab0e04b83f6501d2efd4b4c52f57f41fb3c9f06d9b0afd960c6021N.exe
5428	Fbmohmoh.exe
5448	services.exe
5496	Fdlkdhnk.exe
5512	Fdlkdhnk.exe
5596	Fndpmndl.exe
5624	Fbplml32.exe
5636	Fbplml32.exe
5648	240919-qcycwszdja_0f2303b912c2e4071f4fb9e9703c53e7756ab3246dca03f2329304c1c58cd1c2N.exe
5388	Fnbcgn32.exe
5716	Foclgq32.exe
5760	Fnfmbmbi.exe
5792	Fbbicl32.exe
5844	Filapfbo.exe

Loads dropped DLL 47 IoCs

pid	Process
2708	RatAlerts.exe
2708	RatAlerts.exe
2708	RatAlerts.exe
2708	RatAlerts.exe
2708	RatAlerts.exe
2708	RatAlerts.exe
2708	RatAlerts.exe
2708	RatAlerts.exe
2708	RatAlerts.exe
2708	RatAlerts.exe
2708	RatAlerts.exe
2708	RatAlerts.exe
2708	RatAlerts.exe
2708	RatAlerts.exe
2708	RatAlerts.exe
2708	RatAlerts.exe
2708	RatAlerts.exe
2708	RatAlerts.exe
2708	RatAlerts.exe
2708	RatAlerts.exe
2708	RatAlerts.exe
2708	RatAlerts.exe
2708	RatAlerts.exe
2708	RatAlerts.exe
2708	RatAlerts.exe
2708	RatAlerts.exe
2708	RatAlerts.exe
2708	RatAlerts.exe
2708	RatAlerts.exe
2708	RatAlerts.exe
2708	RatAlerts.exe
2708	RatAlerts.exe
2708	RatAlerts.exe
2708	RatAlerts.exe
2708	RatAlerts.exe
2708	RatAlerts.exe
2708	RatAlerts.exe
2708	RatAlerts.exe
2708	RatAlerts.exe
2708	RatAlerts.exe
2708	RatAlerts.exe
2708	RatAlerts.exe
2708	RatAlerts.exe
2708	RatAlerts.exe
4808	240919-p9gwqszbnd_eb631d5e7add23a6dc50e841a8c98c88_JaffaCakes118.exe
5792	date1.exe
5792	date1.exe

UPX packed file 15 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/4332-1114-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/files/0x000700000002392b-1294.dat	upx
behavioral1/memory/5756-1551-0x0000000000400000-0x0000000000712000-memory.dmp	upx
behavioral1/memory/4552-1503-0x0000000000400000-0x0000000000458000-memory.dmp	upx
behavioral1/memory/4552-1660-0x0000000024010000-0x0000000024072000-memory.dmp	upx
behavioral1/files/0x00070000000239e9-1815.dat	upx
behavioral1/files/0x0007000000023b17-2988.dat	upx
behavioral1/memory/4552-1667-0x0000000024080000-0x00000000240E2000-memory.dmp	upx
behavioral1/memory/5648-1447-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/5448-1441-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/4468-1365-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/memory/4332-1232-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/memory/4320-1245-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/4320-1135-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/files/0x00080000000239aa-8386.dat	upx

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UACDisableNotify = "0"	240919-qb91aszcpe_eb64dbb7b99cbfe581497232b6c09832_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 10 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\windows-dif = "C:\\Windows\\windows\\windows-help.exe"	240919-qskrqs1are_eb6f29af0991d001e0f39f6b062810b4_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	240919-qkp2gs1cnm_643eaa5505d3d177fcef92d75b88904409f2d52224072ea4e9cd7afb19bd4055N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	240919-qnzp4azgra_Worm.Win32.Mydoom.pz5851085fd7c81bbd629d3145500cbbea1d499b80a044b5f1f2a736f66d0dd69bN
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MMoYkMwE.exe = "C:\\ProgramData\\ZkEYAwMc\\MMoYkMwE.exe"	240919-qrwsls1flr_2024-09-19_c526aa84bc26278f2f156a34fbe00a83_virlock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\DQwAwsks.exe = "C:\\Users\\Admin\\GgsIsQsE\\DQwAwsks.exe"	DQwAwsks.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MMoYkMwE.exe = "C:\\ProgramData\\ZkEYAwMc\\MMoYkMwE.exe"	MMoYkMwE.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Users\\Admin\\AppData\\Local\\Temp\\services.exe"	services.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\DQwAwsks.exe = "C:\\Users\\Admin\\GgsIsQsE\\DQwAwsks.exe"	240919-qrwsls1flr_2024-09-19_c526aa84bc26278f2f156a34fbe00a83_virlock.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\windows = "C:\\Windows\\windows\\windows-help.exe"	240919-qskrqs1are_eb6f29af0991d001e0f39f6b062810b4_JaffaCakes118.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	240919-qb91aszcpe_eb64dbb7b99cbfe581497232b6c09832_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	date1.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
10	discord.com
12	discord.com
8	discord.com

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
310	checkip.dyndns.org
317	ip-api.com

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	240919-qb91aszcpe_eb64dbb7b99cbfe581497232b6c09832_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	240919-qb91aszcpe_eb64dbb7b99cbfe581497232b6c09832_JaffaCakes118.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/files/0x0007000000024246-7241.dat	autoit_exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Geoapenf.exe	Fecadghc.exe
File created	C:\Windows\SysWOW64\Dddllkbf.exe	240919-qs2p9a1bka_851f998612344631b54cc755cd168508036121ed3cc0060e94af5d0c3c85ba7fN.exe
File opened for modification	C:\Windows\SysWOW64\Eiekog32.exe	Eqiibjlj.exe
File created	C:\Windows\SysWOW64\Jibclo32.dll	Fbmohmoh.exe
File created	C:\Windows\SysWOW64\Nalhik32.dll	240919-qs2p9a1bka_851f998612344631b54cc755cd168508036121ed3cc0060e94af5d0c3c85ba7fN.exe
File opened for modification	C:\Windows\SysWOW64\Dnonkq32.exe	Dgeenfog.exe
File created	C:\Windows\SysWOW64\Fdlkdhnk.exe	Egcaod32.exe
File opened for modification	C:\Windows\SysWOW64\Fqgedh32.exe	240919-p94eqszgml_48ab527e06366a4e12e140d509afa43cd887cfcf1d9173ffe357441e30bc90f2N.exe
File created	C:\Windows\SysWOW64\Edionhpn.exe	Enmjlojd.exe
File created	C:\Windows\SysWOW64\Fnfmbmbi.exe	Fdlkdhnk.exe
File opened for modification	C:\Windows\SysWOW64\Dognaofl.dll	Klndfj32.exe
File opened for modification	C:\Windows\SysWOW64\Keifdpif.exe	Hlblcn32.exe
File opened for modification	C:\Windows\SysWOW64\Kidben32.exe	Kiphjo32.exe
File created	C:\Windows\SysWOW64\Dkndie32.exe	Dddllkbf.exe
File opened for modification	C:\Windows\SysWOW64\Enhpao32.exe	Edplhjhi.exe
File opened for modification	C:\Windows\SysWOW64\Hpaoan32.dll	240919-qdam8azhpq_6ed813417e50cef43ce169bf8e48fd96e69ef00b4a32288729a3b25ecfcbed30N.exe
File created	C:\Windows\SysWOW64\Ojehbail.dll	Fbplml32.exe
File created	C:\Windows\SysWOW64\Ndjaei32.dll	240919-qj83za1clq_8b071f6d72e774adb139f7408782446f133708591f33d0002e479d9e66fe6eb3N.exe
File created	C:\Windows\SysWOW64\Focanl32.dll	Eiekog32.exe
File created	C:\Windows\SysWOW64\Ddnobj32.exe	240919-qjs2ra1ckl_0b9d0b09198f282ce44c2dd86ecce550c4c63e99efe9bb3ab2f3e34ee7da29c9N.exe
File opened for modification	C:\Windows\SysWOW64\Mkiongah.dll	Fbplml32.exe
File created	C:\Windows\SysWOW64\Plgdqf32.dll	240919-p8wnhazfqn_80ebb66a5b76ab87390005861b0b534bb838752540188face72be2a2f1364803N.exe
File opened for modification	C:\Windows\SysWOW64\Kcoccc32.exe	Kidben32.exe
File created	C:\Windows\SysWOW64\Fkofga32.exe	Filapfbo.exe
File created	C:\Windows\SysWOW64\Lcfidb32.exe	Kocgbend.exe
File created	C:\Windows\SysWOW64\Lhcali32.exe	240919-qd545a1ajm_Backdoor.Win32.Berbew.AA.MTB-30a8a70336c6f59adf4b8a0f7eb6c0206623fb7fa9c2509ca3cf5840814921a5N
File created	C:\Windows\SysWOW64\Fdlkdhnk.exe	Ehpadhll.exe
File opened for modification	C:\Windows\SysWOW64\Fbdehlip.exe	240919-p8wnhazfqn_80ebb66a5b76ab87390005861b0b534bb838752540188face72be2a2f1364803N.exe
File opened for modification	C:\Windows\SysWOW64\Eoongbjn.dll	Fnfmbmbi.exe
File created	C:\Windows\SysWOW64\Lojmcdgl.exe	Kcoccc32.exe
File created	C:\Windows\SysWOW64\Kcoccc32.exe	Kidben32.exe
File created	C:\Windows\SysWOW64\Emlmcm32.dll	240919-qt4k8s1glq_19dab265f48a2fc83ee2411287d5509106326c5c8ffa74cb5befdc5f01b38dc9N.exe
File created	C:\Windows\SysWOW64\Bgnpek32.dll	240919-qkynmazfpc_5de5302fd91cc380c3c47da4b685565874bd2340910cf1362e7b5feec3ae95cdN.exe
File opened for modification	C:\Windows\SysWOW64\Laiipofp.exe	240919-qt4k8s1glq_19dab265f48a2fc83ee2411287d5509106326c5c8ffa74cb5befdc5f01b38dc9N.exe
File created	C:\Windows\SysWOW64\Eiekog32.exe	Eqiibjlj.exe
File created	C:\Windows\SysWOW64\Fbmohmoh.exe	Eiekog32.exe
File created	C:\Windows\SysWOW64\Fkofga32.exe	Fbbicl32.exe
File created	C:\Windows\SysWOW64\Lglmoh32.dll	Kocgbend.exe
File created	C:\Windows\SysWOW64\Dhgonidg.exe	Dnajppda.exe
File created	C:\Windows\SysWOW64\Ehbnigjj.exe	Eqiibjlj.exe
File created	C:\Windows\SysWOW64\Foclgq32.exe	Fbmohmoh.exe
File opened for modification	C:\Windows\SysWOW64\Dddllkbf.exe	240919-qs2p9a1bka_851f998612344631b54cc755cd168508036121ed3cc0060e94af5d0c3c85ba7fN.exe
File opened for modification	C:\Windows\SysWOW64\Dahmfpap.exe	Dkndie32.exe
File created	C:\Windows\SysWOW64\Fgcjfbed.exe	Fbdehlip.exe
File created	C:\Windows\SysWOW64\Ebdlangb.exe	Egohdegl.exe
File created	C:\Windows\SysWOW64\Ljbnfleo.exe	240919-p81bpazfrj_72369386d9596ace4950517c7ef51e300c59cac1cf9c46c0fb9ff95a4a9f51dbN.exe
File created	C:\Windows\SysWOW64\Mlbmonhi.dll	Fdlkdhnk.exe
File created	C:\Windows\SysWOW64\Mkiongah.dll	Fndpmndl.exe
File created	C:\Windows\SysWOW64\Ogeacidl.dll	Fnbcgn32.exe
File created	C:\Windows\SysWOW64\Hapfpelh.dll	Keifdpif.exe
File opened for modification	C:\Windows\SysWOW64\Dkcndeen.exe	240919-qj83za1clq_8b071f6d72e774adb139f7408782446f133708591f33d0002e479d9e66fe6eb3N.exe
File created	C:\Windows\SysWOW64\Kpjbdk32.dll	240919-qc8hvszdjf_b826a05ea57336b45c502e7b917a4976304f7b5ce65f63f82f97111811d68d90N.exe
File opened for modification	C:\Windows\SysWOW64\Fbplml32.exe	Ekcgkb32.exe
File opened for modification	C:\Windows\SysWOW64\Fecadghc.exe	Fnbcgn32.exe
File created	C:\Windows\SysWOW64\Fkofga32.exe	Fnfmbmbi.exe
File created	C:\Windows\SysWOW64\Hlblcn32.exe	Geoapenf.exe
File created	C:\Windows\SysWOW64\Kidben32.exe	Kiphjo32.exe
File created	C:\Windows\SysWOW64\Dognaofl.dll	Kiphjo32.exe
File created	C:\Windows\SysWOW64\Enhpao32.exe	Edplhjhi.exe
File opened for modification	C:\Windows\SysWOW64\Hpahkbdh.dll	Edbiniff.exe
File opened for modification	C:\Windows\SysWOW64\Edionhpn.exe	Enmjlojd.exe
File opened for modification	C:\Windows\SysWOW64\Fgcjfbed.exe	Fbdehlip.exe
File created	C:\Windows\SysWOW64\Apjfbb32.dll	240919-p81bpazfrj_72369386d9596ace4950517c7ef51e300c59cac1cf9c46c0fb9ff95a4a9f51dbN.exe
File created	C:\Windows\SysWOW64\Jfhmgagf.dll	Ekjded32.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 5920 set thread context of 5824	5920	240919-qb91aszcpe_eb64dbb7b99cbfe581497232b6c09832_JaffaCakes118.exe	193
PID 5920 set thread context of 2460	5920	240919-qb91aszcpe_eb64dbb7b99cbfe581497232b6c09832_JaffaCakes118.exe	199
PID 5824 set thread context of 1276	5824	240919-qb91aszcpe_eb64dbb7b99cbfe581497232b6c09832_JaffaCakes118.exe	207

Drops file in Windows directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\java.exe	240919-qnzp4azgra_Worm.Win32.Mydoom.pz5851085fd7c81bbd629d3145500cbbea1d499b80a044b5f1f2a736f66d0dd69bN
File created	C:\Windows\java.exe	240919-qnzp4azgra_Worm.Win32.Mydoom.pz5851085fd7c81bbd629d3145500cbbea1d499b80a044b5f1f2a736f66d0dd69bN
File created	C:\Windows\windows\windows-help.exe	240919-qskrqs1are_eb6f29af0991d001e0f39f6b062810b4_JaffaCakes118.exe
File opened for modification	C:\Windows\windows\windows-help.exe	240919-qskrqs1are_eb6f29af0991d001e0f39f6b062810b4_JaffaCakes118.exe
File created	C:\Windows\services.exe	240919-qkp2gs1cnm_643eaa5505d3d177fcef92d75b88904409f2d52224072ea4e9cd7afb19bd4055N.exe
File opened for modification	C:\Windows\java.exe	240919-qkp2gs1cnm_643eaa5505d3d177fcef92d75b88904409f2d52224072ea4e9cd7afb19bd4055N.exe
File created	C:\Windows\java.exe	240919-qkp2gs1cnm_643eaa5505d3d177fcef92d75b88904409f2d52224072ea4e9cd7afb19bd4055N.exe
File created	C:\Windows\services.exe	240919-qnzp4azgra_Worm.Win32.Mydoom.pz5851085fd7c81bbd629d3145500cbbea1d499b80a044b5f1f2a736f66d0dd69bN

Launches sc.exe 7 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
19352	sc.exe
18976	sc.exe
18976	Process not Found
4360	Process not Found
15904	Process not Found
11896	Process not Found
18072	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 15 IoCs

pid	pid_target	Process	procid_target
7320	3564	WerFault.exe	165
7304	5128	WerFault.exe	223
7420	1216	WerFault.exe	224
14956	4804	WerFault.exe	240
4504	11672	WerFault.exe
15924	7424	WerFault.exe	333
16976	2288	Process not Found	1148
2284	6516	Process not Found	1147
5440	4820	WerFault.exe
8328	16948	Process not Found	1169
12736	15720	Process not Found	1151
17592	16948	Process not Found	1169
11364	14052	Process not Found	1389
17160	14816	Process not Found	1447
18728	17176	Process not Found	1022

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dkcndeen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eqiibjlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kcoccc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	240919-qlayys1cqm_eb6a663833d81c3fb6ec63f1b32b19ee_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Keifdpif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kcoccc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	240919-qscq5a1aqd_6c414fba6f89bca0e6ad7bd4b4fb161d7d3a758a66fe6cdd826656cbb5e6fa54N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	240919-p9gwqszbnd_eb631d5e7add23a6dc50e841a8c98c88_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ekcgkb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MMoYkMwE.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	240919-qktpnszfnh_44c2bc170fd3a4981a56fccdc449ad90b646b0d71c1793824fcfe28f36aea697N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fdlkdhnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	240919-p8wnhazfqn_80ebb66a5b76ab87390005861b0b534bb838752540188face72be2a2f1364803N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Edionhpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	240919-qnzp4azgra_Worm.Win32.Mydoom.pz5851085fd7c81bbd629d3145500cbbea1d499b80a044b5f1f2a736f66d0dd69bN
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fbmohmoh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CKM.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fnbcgn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Geoapenf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9vvjv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	240919-qtpr3s1gjr_eb7013e136110485304f64a352178c2e_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hlblcn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kidben32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jvdvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dnonkq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fgcjfbed.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	240919-qkynmazfpc_5de5302fd91cc380c3c47da4b685565874bd2340910cf1362e7b5feec3ae95cdN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lcfidb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kiphjo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lhcali32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dgeenfog.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eqiibjlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eiekog32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Egohdegl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	240919-qj3aeszfkg_75c6406f46645aba1afbeba7402c51bbfcb81d6536780637bb621e55c34a2b15N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Enpfan32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	240919-p94eqszgml_48ab527e06366a4e12e140d509afa43cd887cfcf1d9173ffe357441e30bc90f2N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	240919-qkk3jazfmh_Backdoor.Win32.Berbew.AA.MTB-35f1edad02c11ad69e15e9cb5eacff172fcd54cb25649d62bd5f7875906f6b7cN
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ekajec32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Egcaod32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	240919-qdam8azhpq_6ed813417e50cef43ce169bf8e48fd96e69ef00b4a32288729a3b25ecfcbed30N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	240919-qb91aszcpe_eb64dbb7b99cbfe581497232b6c09832_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	240919-qkh8ya1cmm_bc3d5d77e96f00f8558719d43dbd24274073169093539acd5acc78a9dab3941aN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dqpfmlce.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fnfmbmbi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Klndfj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	date1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	240919-p81bpazfrj_72369386d9596ace4950517c7ef51e300c59cac1cf9c46c0fb9ff95a4a9f51dbN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ljbnfleo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dkekjdck.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fniihmpf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Filapfbo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DQwAwsks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Foclgq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ehbnigjj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	services.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	240919-qjqlma1cjq_eb6960061aadd7275f9b6acf20b20c5b_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	240919-p8q31szfpp_Backdoor.Win32.Berbew.AA.MTB90cc4bc0699dcaf31f7d42ef592904c7641ac7d81f2038768f3a4056d91634fcN
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	240919-qs2p9a1bka_851f998612344631b54cc755cd168508036121ed3cc0060e94af5d0c3c85ba7fN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dddllkbf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dglkoeio.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Enhpao32.exe

System Time Discovery 1 TTPs 4 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1312	Process not Found
14048	Process not Found
17072	Process not Found
12212	Process not Found

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dkndie32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dkndie32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Abbqppqg.dll"	240919-qaah2szbqg_bf16782f1bb5625296e22bb444aac8d330b03cdfc73f4e8d0a22e9daf77cbf40N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Eqiibjlj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ekcgkb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	240919-qaah2szbqg_bf16782f1bb5625296e22bb444aac8d330b03cdfc73f4e8d0a22e9daf77cbf40N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Egcaod32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fdlkdhnk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	240919-p81bpazfrj_72369386d9596ace4950517c7ef51e300c59cac1cf9c46c0fb9ff95a4a9f51dbN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kpjbdk32.dll"	240919-qc8hvszdjf_b826a05ea57336b45c502e7b917a4976304f7b5ce65f63f82f97111811d68d90N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jhkilook.dll"	Enfckp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Edplhjhi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ieppioao.dll"	Edplhjhi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Diadam32.dll"	240919-qd545a1ajm_Backdoor.Win32.Berbew.AA.MTB-30a8a70336c6f59adf4b8a0f7eb6c0206623fb7fa9c2509ca3cf5840814921a5N
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jabphdjm.dll"	Dgeenfog.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Egohdegl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	240919-qdam8azhpq_6ed813417e50cef43ce169bf8e48fd96e69ef00b4a32288729a3b25ecfcbed30N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fqgedh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fqgedh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	240919-p9mf8azgkm_60b9d964ccf958454decab62bcb12b3479ffef67241c36e4b3d93e51c2c212a2N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Akcjcnpe.dll"	Eqiibjlj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fbplml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eoongbjn.dll"	Filapfbo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fbbicl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fkofga32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	240919-qaykwazcjf_14dfa1ef04263fbaa0dada0a3409b98ada640a9464c5e29f5f42cc68ef07e5c8N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	240919-qj3aeszfkg_75c6406f46645aba1afbeba7402c51bbfcb81d6536780637bb621e55c34a2b15N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Begfqa32.dll"	Ehbnigjj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jibclo32.dll"	Fbmohmoh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dognaofl.dll"	Klndfj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Kidben32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	240919-p94eqszgml_48ab527e06366a4e12e140d509afa43cd887cfcf1d9173ffe357441e30bc90f2N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dbnapajp.dll"	Fbdehlip.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hpmhdmea.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ehbnigjj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Eiekog32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dddllkbf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dgeenfog.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	240919-qkh8ya1cmm_bc3d5d77e96f00f8558719d43dbd24274073169093539acd5acc78a9dab3941aN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nalhik32.dll"	240919-qs2p9a1bka_851f998612344631b54cc755cd168508036121ed3cc0060e94af5d0c3c85ba7fN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lbfecjhc.dll"	240919-p89v5azbmd_0bec6a5d23ec34155a4a5b5c4ae3dcd99e70415da6922b5cfc6aca06fac442bdN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dddllkbf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hpmhdmea.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	240919-p8q31szfpp_Backdoor.Win32.Berbew.AA.MTB90cc4bc0699dcaf31f7d42ef592904c7641ac7d81f2038768f3a4056d91634fcN
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Opkkbnec.dll"	Fkofga32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ojidbohn.dll"	240919-qj3aeszfkg_75c6406f46645aba1afbeba7402c51bbfcb81d6536780637bb621e55c34a2b15N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eoongbjn.dll"	Fbbicl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	240919-p89v5azbmd_0bec6a5d23ec34155a4a5b5c4ae3dcd99e70415da6922b5cfc6aca06fac442bdN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Enpfan32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fbmohmoh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fnfmbmbi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hlblcn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Kidben32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	240919-qs2p9a1bka_851f998612344631b54cc755cd168508036121ed3cc0060e94af5d0c3c85ba7fN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hpahkbdh.dll"	Edbiniff.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Focanl32.dll"	Eiekog32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	240919-qc8hvszdjf_b826a05ea57336b45c502e7b917a4976304f7b5ce65f63f82f97111811d68d90N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hapfpelh.dll"	Keifdpif.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ekajec32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ofblbapl.dll"	Fdlkdhnk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Filapfbo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Emlmcm32.dll"	240919-qt4k8s1glq_19dab265f48a2fc83ee2411287d5509106326c5c8ffa74cb5befdc5f01b38dc9N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pegopgia.dll"	Dglkoeio.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Egohdegl.exe

Modifies registry key 1 TTPs 27 IoCs

Modify Registry

T1112

pid	Process
12256	reg.exe
13760	Process not Found
10196	Process not Found
4028	reg.exe
5200	reg.exe
13372	Process not Found
17220	Process not Found
4136	Process not Found
11060	Process not Found
2972	reg.exe
18268	Process not Found
11836	Process not Found
19420	Process not Found
16648	Process not Found
20140	Process not Found
1324	reg.exe
1784	Process not Found
12240	reg.exe
17340	Process not Found
18656	Process not Found
16960	Process not Found
8840	Process not Found
12080	Process not Found
12248	reg.exe
6124	reg.exe
6936	Process not Found
5632	reg.exe

Runs net.exe

Runs regedit.exe 1 IoCs

pid	Process
18044	regedit.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 47 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
10496	Process not Found
2064	Process not Found
11916	Process not Found
14480	Process not Found
18624	Process not Found
9848	Process not Found
15860	Process not Found
5280	schtasks.exe
18804	Process not Found
16908	Process not Found
4604	Process not Found
4348	Process not Found
13300	Process not Found
2256	Process not Found
15252	schtasks.exe
14176	Process not Found
11380	Process not Found
964	Process not Found
13292	Process not Found
8212	Process not Found
10504	Process not Found
10756	Process not Found
12560	Process not Found
19108	Process not Found
17956	Process not Found
1784	schtasks.exe
12068	Process not Found
12084	Process not Found
4976	Process not Found
18348	Process not Found
2180	Process not Found
16644	Process not Found
1604	Process not Found
19044	Process not Found
18292	Process not Found
1356	Process not Found
14800	Process not Found
1356	Process not Found
9780	Process not Found
18584	Process not Found
1084	Process not Found
14248	Process not Found
9672	Process not Found
15236	Process not Found
13372	Process not Found
2472	Process not Found
14828	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4612	240919-qrwsls1flr_2024-09-19_c526aa84bc26278f2f156a34fbe00a83_virlock.exe
4612	240919-qrwsls1flr_2024-09-19_c526aa84bc26278f2f156a34fbe00a83_virlock.exe
4612	240919-qrwsls1flr_2024-09-19_c526aa84bc26278f2f156a34fbe00a83_virlock.exe
4612	240919-qrwsls1flr_2024-09-19_c526aa84bc26278f2f156a34fbe00a83_virlock.exe
4552	240919-qskrqs1are_eb6f29af0991d001e0f39f6b062810b4_JaffaCakes118.exe
4552	240919-qskrqs1are_eb6f29af0991d001e0f39f6b062810b4_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4296	240919-qbmvrszcmb_DetestationPaidSpoofer.exe
Token: SeBackupPrivilege	5920	240919-qb91aszcpe_eb64dbb7b99cbfe581497232b6c09832_JaffaCakes118.exe
Token: SeDebugPrivilege	5792	date1.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2128	240919-qkmw5azfnb_Trojan.Win32.Vilsel.pz1ed26b1a1d6b36f43a2250b898323ff1b7de4e6aae213bedbaca2f96c5d8b11bN
4552	240919-qskrqs1are_eb6f29af0991d001e0f39f6b062810b4_JaffaCakes118.exe
5648	240919-qcycwszdja_0f2303b912c2e4071f4fb9e9703c53e7756ab3246dca03f2329304c1c58cd1c2N.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
2128	240919-qkmw5azfnb_Trojan.Win32.Vilsel.pz1ed26b1a1d6b36f43a2250b898323ff1b7de4e6aae213bedbaca2f96c5d8b11bN
5648	240919-qcycwszdja_0f2303b912c2e4071f4fb9e9703c53e7756ab3246dca03f2329304c1c58cd1c2N.exe
5240	240919-qtpr3s1gjr_eb7013e136110485304f64a352178c2e_JaffaCakes118.exe
5920	240919-qb91aszcpe_eb64dbb7b99cbfe581497232b6c09832_JaffaCakes118.exe
6048	240919-qktpnszfnh_44c2bc170fd3a4981a56fccdc449ad90b646b0d71c1793824fcfe28f36aea697N.exe
5824	240919-qb91aszcpe_eb64dbb7b99cbfe581497232b6c09832_JaffaCakes118.exe
5792	date1.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
5756	240919-qjqlma1cjq_eb6960061aadd7275f9b6acf20b20c5b_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1144 wrote to memory of 2708	1144	RatAlerts.exe	83
PID 1144 wrote to memory of 2708	1144	RatAlerts.exe	83
PID 2708 wrote to memory of 4768	2708	RatAlerts.exe	84
PID 2708 wrote to memory of 4768	2708	RatAlerts.exe	84
PID 2708 wrote to memory of 4996	2708	RatAlerts.exe	85
PID 2708 wrote to memory of 4996	2708	RatAlerts.exe	85
PID 2708 wrote to memory of 352	2708	RatAlerts.exe	86
PID 2708 wrote to memory of 352	2708	RatAlerts.exe	86
PID 2708 wrote to memory of 352	2708	RatAlerts.exe	86
PID 2708 wrote to memory of 2128	2708	RatAlerts.exe	87
PID 2708 wrote to memory of 2128	2708	RatAlerts.exe	87
PID 2708 wrote to memory of 2128	2708	RatAlerts.exe	87
PID 352 wrote to memory of 1660	352	240919-qs2p9a1bka_851f998612344631b54cc755cd168508036121ed3cc0060e94af5d0c3c85ba7fN.exe	88
PID 352 wrote to memory of 1660	352	240919-qs2p9a1bka_851f998612344631b54cc755cd168508036121ed3cc0060e94af5d0c3c85ba7fN.exe	88
PID 352 wrote to memory of 1660	352	240919-qs2p9a1bka_851f998612344631b54cc755cd168508036121ed3cc0060e94af5d0c3c85ba7fN.exe	88
PID 1660 wrote to memory of 2564	1660	Dddllkbf.exe	244
PID 1660 wrote to memory of 2564	1660	Dddllkbf.exe	244
PID 1660 wrote to memory of 2564	1660	Dddllkbf.exe	244
PID 2564 wrote to memory of 4000	2564	Dkndie32.exe	1034
PID 2564 wrote to memory of 4000	2564	Dkndie32.exe	1034
PID 2564 wrote to memory of 4000	2564	Dkndie32.exe	1034
PID 4000 wrote to memory of 2396	4000	Dahmfpap.exe	91
PID 4000 wrote to memory of 2396	4000	Dahmfpap.exe	91
PID 4000 wrote to memory of 2396	4000	Dahmfpap.exe	91
PID 2708 wrote to memory of 4332	2708	RatAlerts.exe	92
PID 2708 wrote to memory of 4332	2708	RatAlerts.exe	92
PID 2708 wrote to memory of 4332	2708	RatAlerts.exe	92
PID 2396 wrote to memory of 1056	2396	Dgeenfog.exe	93
PID 2396 wrote to memory of 1056	2396	Dgeenfog.exe	93
PID 2396 wrote to memory of 1056	2396	Dgeenfog.exe	93
PID 2708 wrote to memory of 2932	2708	RatAlerts.exe	690
PID 2708 wrote to memory of 2932	2708	RatAlerts.exe	690
PID 2708 wrote to memory of 2932	2708	RatAlerts.exe	690
PID 4332 wrote to memory of 4320	4332	240919-qkp2gs1cnm_643eaa5505d3d177fcef92d75b88904409f2d52224072ea4e9cd7afb19bd4055N.exe	96
PID 4332 wrote to memory of 4320	4332	240919-qkp2gs1cnm_643eaa5505d3d177fcef92d75b88904409f2d52224072ea4e9cd7afb19bd4055N.exe	96
PID 4332 wrote to memory of 4320	4332	240919-qkp2gs1cnm_643eaa5505d3d177fcef92d75b88904409f2d52224072ea4e9cd7afb19bd4055N.exe	96
PID 2708 wrote to memory of 3056	2708	RatAlerts.exe	94
PID 2708 wrote to memory of 3056	2708	RatAlerts.exe	94
PID 2708 wrote to memory of 3056	2708	RatAlerts.exe	94
PID 2708 wrote to memory of 2008	2708	RatAlerts.exe	97
PID 2708 wrote to memory of 2008	2708	RatAlerts.exe	97
PID 2708 wrote to memory of 2008	2708	RatAlerts.exe	97
PID 2932 wrote to memory of 4528	2932	240919-qj83za1clq_8b071f6d72e774adb139f7408782446f133708591f33d0002e479d9e66fe6eb3N.exe	98
PID 2932 wrote to memory of 4528	2932	240919-qj83za1clq_8b071f6d72e774adb139f7408782446f133708591f33d0002e479d9e66fe6eb3N.exe	98
PID 2932 wrote to memory of 4528	2932	240919-qj83za1clq_8b071f6d72e774adb139f7408782446f133708591f33d0002e479d9e66fe6eb3N.exe	98
PID 2008 wrote to memory of 4820	2008	240919-qkh8ya1cmm_bc3d5d77e96f00f8558719d43dbd24274073169093539acd5acc78a9dab3941aN.exe	99
PID 2008 wrote to memory of 4820	2008	240919-qkh8ya1cmm_bc3d5d77e96f00f8558719d43dbd24274073169093539acd5acc78a9dab3941aN.exe	99
PID 2008 wrote to memory of 4820	2008	240919-qkh8ya1cmm_bc3d5d77e96f00f8558719d43dbd24274073169093539acd5acc78a9dab3941aN.exe	99
PID 2708 wrote to memory of 4020	2708	RatAlerts.exe	100
PID 2708 wrote to memory of 4020	2708	RatAlerts.exe	100
PID 2708 wrote to memory of 4020	2708	RatAlerts.exe	100
PID 2708 wrote to memory of 1060	2708	RatAlerts.exe	101
PID 2708 wrote to memory of 1060	2708	RatAlerts.exe	101
PID 2708 wrote to memory of 1060	2708	RatAlerts.exe	101
PID 1056 wrote to memory of 2468	1056	Dnonkq32.exe	1108
PID 1056 wrote to memory of 2468	1056	Dnonkq32.exe	1108
PID 1056 wrote to memory of 2468	1056	Dnonkq32.exe	1108
PID 4528 wrote to memory of 4756	4528	Dkcndeen.exe	103
PID 4528 wrote to memory of 4756	4528	Dkcndeen.exe	103
PID 4528 wrote to memory of 4756	4528	Dkcndeen.exe	103
PID 2708 wrote to memory of 4296	2708	RatAlerts.exe	105
PID 2708 wrote to memory of 4296	2708	RatAlerts.exe	105
PID 1060 wrote to memory of 3816	1060	240919-qc8hvszdjf_b826a05ea57336b45c502e7b917a4976304f7b5ce65f63f82f97111811d68d90N.exe	106
PID 1060 wrote to memory of 3816	1060	240919-qc8hvszdjf_b826a05ea57336b45c502e7b917a4976304f7b5ce65f63f82f97111811d68d90N.exe	106

System policy modification 1 TTPs 7 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	240919-qktpnszfnh_44c2bc170fd3a4981a56fccdc449ad90b646b0d71c1793824fcfe28f36aea697N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	240919-qkmw5azfnb_Trojan.Win32.Vilsel.pz1ed26b1a1d6b36f43a2250b898323ff1b7de4e6aae213bedbaca2f96c5d8b11bN
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	240919-qkmw5azfnb_Trojan.Win32.Vilsel.pz1ed26b1a1d6b36f43a2250b898323ff1b7de4e6aae213bedbaca2f96c5d8b11bN
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	240919-qcycwszdja_0f2303b912c2e4071f4fb9e9703c53e7756ab3246dca03f2329304c1c58cd1c2N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	240919-qcycwszdja_0f2303b912c2e4071f4fb9e9703c53e7756ab3246dca03f2329304c1c58cd1c2N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	240919-qb91aszcpe_eb64dbb7b99cbfe581497232b6c09832_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	240919-qktpnszfnh_44c2bc170fd3a4981a56fccdc449ad90b646b0d71c1793824fcfe28f36aea697N.exe

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
11588	Process not Found
5984	Process not Found

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3472
- C:\Users\Admin\AppData\Local\Temp\RatAlerts.exe
  "C:\Users\Admin\AppData\Local\Temp\RatAlerts.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1144
- - C:\Users\Admin\AppData\Local\Temp\RatAlerts.exe
    "C:\Users\Admin\AppData\Local\Temp\RatAlerts.exe"
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2708
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "ver"
      4⤵
      PID:4768
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c cls
      4⤵
      PID:4996
  - - C:\Users\Admin\Downloads\240919-qs2p9a1bka_851f998612344631b54cc755cd168508036121ed3cc0060e94af5d0c3c85ba7fN.exe
      C:\Users\Admin\Downloads\240919-qs2p9a1bka_851f998612344631b54cc755cd168508036121ed3cc0060e94af5d0c3c85ba7fN.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:352
    - - C:\Windows\SysWOW64\Dddllkbf.exe
        
        C:\Windows\system32\Dddllkbf.exe
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1660
      - C:\Windows\SysWOW64\Dkndie32.exe
        
        C:\Windows\system32\Dkndie32.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2564
        
        C:\Windows\SysWOW64\Dahmfpap.exe
        
        C:\Windows\system32\Dahmfpap.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4000
        
        C:\Windows\SysWOW64\Dgeenfog.exe
        
        C:\Windows\system32\Dgeenfog.exe
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2396
        
        C:\Windows\SysWOW64\Dnonkq32.exe
        
        C:\Windows\system32\Dnonkq32.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1056
        
        C:\Windows\SysWOW64\Dqpfmlce.exe
        
        C:\Windows\system32\Dqpfmlce.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2468
        
        C:\Windows\SysWOW64\Enfckp32.exe
        
        C:\Windows\system32\Enfckp32.exe
        11⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2432
        
        C:\Windows\SysWOW64\Egohdegl.exe
        
        C:\Windows\system32\Egohdegl.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4516
        
        C:\Windows\SysWOW64\Ebdlangb.exe
        
        C:\Windows\system32\Ebdlangb.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:5048
        
        C:\Windows\SysWOW64\Ehpadhll.exe
        
        C:\Windows\system32\Ehpadhll.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4432
        
        C:\Windows\SysWOW64\Fdlkdhnk.exe
        
        C:\Windows\system32\Fdlkdhnk.exe
        15⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:5496
        
        C:\Windows\SysWOW64\Fnfmbmbi.exe
        
        C:\Windows\system32\Fnfmbmbi.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5760
  - - C:\Users\Admin\Downloads\240919-qkmw5azfnb_Trojan.Win32.Vilsel.pz1ed26b1a1d6b36f43a2250b898323ff1b7de4e6aae213bedbaca2f96c5d8b11bN
      C:\Users\Admin\Downloads\240919-qkmw5azfnb_Trojan.Win32.Vilsel.pz1ed26b1a1d6b36f43a2250b898323ff1b7de4e6aae213bedbaca2f96c5d8b11bN
      4⤵
      Modifies visibility of file extensions in Explorer
      Executes dropped EXE
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      System policy modification
      PID:2128
  - - C:\Users\Admin\Downloads\240919-qkp2gs1cnm_643eaa5505d3d177fcef92d75b88904409f2d52224072ea4e9cd7afb19bd4055N.exe
      C:\Users\Admin\Downloads\240919-qkp2gs1cnm_643eaa5505d3d177fcef92d75b88904409f2d52224072ea4e9cd7afb19bd4055N.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious use of WriteProcessMemory
      PID:4332
    - - C:\Windows\services.exe
        
        "C:\Windows\services.exe"
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        
        PID:4320
  - - C:\Users\Admin\Downloads\240919-qkjvga1cmn_eb69e5c48d13d4a1b33ca72ac6500830_JaffaCakes118.exe
      C:\Users\Admin\Downloads\240919-qkjvga1cmn_eb69e5c48d13d4a1b33ca72ac6500830_JaffaCakes118.exe
      4⤵
      Modifies firewall policy service
      Executes dropped EXE
      PID:3056
  - - C:\Users\Admin\Downloads\240919-qj83za1clq_8b071f6d72e774adb139f7408782446f133708591f33d0002e479d9e66fe6eb3N.exe
      C:\Users\Admin\Downloads\240919-qj83za1clq_8b071f6d72e774adb139f7408782446f133708591f33d0002e479d9e66fe6eb3N.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:2932
    - - C:\Windows\SysWOW64\Dkcndeen.exe
        
        C:\Windows\system32\Dkcndeen.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4528
      - C:\Windows\SysWOW64\Dhgonidg.exe
        
        C:\Windows\system32\Dhgonidg.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4756
        
        C:\Windows\SysWOW64\Ddnobj32.exe
        
        C:\Windows\system32\Ddnobj32.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4452
        
        C:\Windows\SysWOW64\Ekjded32.exe
        
        C:\Windows\system32\Ekjded32.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3828
        
        C:\Windows\SysWOW64\Edbiniff.exe
        
        C:\Windows\system32\Edbiniff.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:696
        
        C:\Windows\SysWOW64\Eqiibjlj.exe
        
        C:\Windows\system32\Eqiibjlj.exe
        10⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1296
        
        C:\Windows\SysWOW64\Ehbnigjj.exe
        
        C:\Windows\system32\Ehbnigjj.exe
        11⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2828
        
        C:\Windows\SysWOW64\Ekcgkb32.exe
        
        C:\Windows\system32\Ekcgkb32.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5328
        
        C:\Windows\SysWOW64\Fbplml32.exe
        
        C:\Windows\system32\Fbplml32.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:5624
        
        C:\Windows\SysWOW64\Filapfbo.exe
        
        C:\Windows\system32\Filapfbo.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5864
  - - C:\Users\Admin\Downloads\240919-qkh8ya1cmm_bc3d5d77e96f00f8558719d43dbd24274073169093539acd5acc78a9dab3941aN.exe
      C:\Users\Admin\Downloads\240919-qkh8ya1cmm_bc3d5d77e96f00f8558719d43dbd24274073169093539acd5acc78a9dab3941aN.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:2008
    - - C:\Windows\SysWOW64\Dnajppda.exe
        
        C:\Windows\system32\Dnajppda.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4820
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4820 -s 408
        6⤵
        Program crash
        
        PID:5440
  - - C:\Users\Admin\Downloads\240919-qjs2ra1ckl_0b9d0b09198f282ce44c2dd86ecce550c4c63e99efe9bb3ab2f3e34ee7da29c9N.exe
      C:\Users\Admin\Downloads\240919-qjs2ra1ckl_0b9d0b09198f282ce44c2dd86ecce550c4c63e99efe9bb3ab2f3e34ee7da29c9N.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      PID:4020
  - - C:\Users\Admin\Downloads\240919-qc8hvszdjf_b826a05ea57336b45c502e7b917a4976304f7b5ce65f63f82f97111811d68d90N.exe
      C:\Users\Admin\Downloads\240919-qc8hvszdjf_b826a05ea57336b45c502e7b917a4976304f7b5ce65f63f82f97111811d68d90N.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:1060
    - - C:\Windows\SysWOW64\Dkekjdck.exe
        
        C:\Windows\system32\Dkekjdck.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3816
      - C:\Windows\SysWOW64\Dglkoeio.exe
        
        C:\Windows\system32\Dglkoeio.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3800
        
        C:\Windows\SysWOW64\Edplhjhi.exe
        
        C:\Windows\system32\Edplhjhi.exe
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2772
        
        C:\Windows\SysWOW64\Enhpao32.exe
        
        C:\Windows\system32\Enhpao32.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1080
        
        C:\Windows\SysWOW64\Eqiibjlj.exe
        
        C:\Windows\system32\Eqiibjlj.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1696
        
        C:\Windows\SysWOW64\Eiekog32.exe
        
        C:\Windows\system32\Eiekog32.exe
        10⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5268
        
        C:\Windows\SysWOW64\Fbmohmoh.exe
        
        C:\Windows\system32\Fbmohmoh.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5428
        
        C:\Windows\SysWOW64\Foclgq32.exe
        
        C:\Windows\system32\Foclgq32.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5716
  - - C:\Users\Admin\Downloads\240919-qbmvrszcmb_DetestationPaidSpoofer.exe
      C:\Users\Admin\Downloads\240919-qbmvrszcmb_DetestationPaidSpoofer.exe
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:4296
  - - C:\Users\Admin\Downloads\240919-qczkyszhnp_eb655f9a969019a6e01f3480e77344ba_JaffaCakes118.exe
      C:\Users\Admin\Downloads\240919-qczkyszhnp_eb655f9a969019a6e01f3480e77344ba_JaffaCakes118.exe
      4⤵
      Executes dropped EXE
      PID:4160
    - - C:\Users\Admin\AppData\Local\Temp\date1.exe
        
        C:\Users\Admin\AppData\Local\Temp\date1.exe
        5⤵
        Loads dropped DLL
        Checks whether UAC is enabled
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:5792
  - - C:\Users\Admin\Downloads\240919-qkk3jazfmh_Backdoor.Win32.Berbew.AA.MTB-35f1edad02c11ad69e15e9cb5eacff172fcd54cb25649d62bd5f7875906f6b7cN
      C:\Users\Admin\Downloads\240919-qkk3jazfmh_Backdoor.Win32.Berbew.AA.MTB-35f1edad02c11ad69e15e9cb5eacff172fcd54cb25649d62bd5f7875906f6b7cN
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2464
    - - C:\Windows\SysWOW64\Ekajec32.exe
        
        C:\Windows\system32\Ekajec32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2856
      - C:\Windows\SysWOW64\Fnbcgn32.exe
        
        C:\Windows\system32\Fnbcgn32.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5388
        
        C:\Windows\SysWOW64\Fecadghc.exe
        
        C:\Windows\system32\Fecadghc.exe
        7⤵
        Drops file in System32 directory
        
        PID:6036
        
        C:\Windows\SysWOW64\Geoapenf.exe
        
        C:\Windows\system32\Geoapenf.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2808
        
        C:\Windows\SysWOW64\Hlblcn32.exe
        
        C:\Windows\system32\Hlblcn32.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2288
        
        C:\Windows\SysWOW64\Keifdpif.exe
        
        C:\Windows\system32\Keifdpif.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2172
        
        C:\Windows\SysWOW64\Kocgbend.exe
        
        C:\Windows\system32\Kocgbend.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5196
  - - C:\Users\Admin\Downloads\240919-p9mf8azgkm_60b9d964ccf958454decab62bcb12b3479ffef67241c36e4b3d93e51c2c212a2N.exe
      C:\Users\Admin\Downloads\240919-p9mf8azgkm_60b9d964ccf958454decab62bcb12b3479ffef67241c36e4b3d93e51c2c212a2N.exe
      4⤵
      Executes dropped EXE
      Modifies registry class
      PID:1880
    - - C:\Windows\SysWOW64\Egcaod32.exe
        
        C:\Windows\system32\Egcaod32.exe
        5⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:440
      - C:\Windows\SysWOW64\Fdlkdhnk.exe
        
        C:\Windows\system32\Fdlkdhnk.exe
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5512
        
        C:\Windows\SysWOW64\Fbbicl32.exe
        
        C:\Windows\system32\Fbbicl32.exe
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:5792
  - - C:\Users\Admin\Downloads\240919-qrwsls1flr_2024-09-19_c526aa84bc26278f2f156a34fbe00a83_virlock.exe
      C:\Users\Admin\Downloads\240919-qrwsls1flr_2024-09-19_c526aa84bc26278f2f156a34fbe00a83_virlock.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious behavior: EnumeratesProcesses
      PID:4612
    - - C:\Users\Admin\GgsIsQsE\DQwAwsks.exe
        
        "C:\Users\Admin\GgsIsQsE\DQwAwsks.exe"
        5⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:6008
    - - C:\ProgramData\ZkEYAwMc\MMoYkMwE.exe
        
        "C:\ProgramData\ZkEYAwMc\MMoYkMwE.exe"
        5⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:6052
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\240919-qrwsls1flr_2024-09-19_c526aa84bc26278f2f156a34fbe00a83_virlock"
        5⤵
        
        PID:6084
      - C:\Users\Admin\Downloads\240919-qrwsls1flr_2024-09-19_c526aa84bc26278f2f156a34fbe00a83_virlock.exe
        
        C:\Users\Admin\Downloads\240919-qrwsls1flr_2024-09-19_c526aa84bc26278f2f156a34fbe00a83_virlock
        6⤵
        
        PID:17400
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        5⤵
        Modifies registry key
        
        PID:1324
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        5⤵
        Modifies registry key
        
        PID:5200
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        5⤵
        Modifies registry key
        
        PID:5632
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\LSckMsAo.bat" "C:\Users\Admin\Downloads\240919-qrwsls1flr_2024-09-19_c526aa84bc26278f2f156a34fbe00a83_virlock.exe""
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5244
      - C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5356
  - - C:\Users\Admin\Downloads\240919-qscq5a1aqd_6c414fba6f89bca0e6ad7bd4b4fb161d7d3a758a66fe6cdd826656cbb5e6fa54N.exe
      C:\Users\Admin\Downloads\240919-qscq5a1aqd_6c414fba6f89bca0e6ad7bd4b4fb161d7d3a758a66fe6cdd826656cbb5e6fa54N.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4800
    - - C:\Windows\SysWOW64\Enpfan32.exe
        
        C:\Windows\system32\Enpfan32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3316
      - C:\Windows\SysWOW64\Fbplml32.exe
        
        C:\Windows\system32\Fbplml32.exe
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5636
        
        C:\Windows\SysWOW64\Fkofga32.exe
        
        C:\Windows\system32\Fkofga32.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5140
  - - C:\Users\Admin\Downloads\240919-p9gwqszbnd_eb631d5e7add23a6dc50e841a8c98c88_JaffaCakes118.exe
      C:\Users\Admin\Downloads\240919-p9gwqszbnd_eb631d5e7add23a6dc50e841a8c98c88_JaffaCakes118.exe
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:4808
    - - C:\Windows\SysWOW64\CKM.exe
        
        "C:\Windows\system32\CKM.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1880
  - - C:\Users\Admin\Downloads\240919-qj3aeszfkg_75c6406f46645aba1afbeba7402c51bbfcb81d6536780637bb621e55c34a2b15N.exe
      C:\Users\Admin\Downloads\240919-qj3aeszfkg_75c6406f46645aba1afbeba7402c51bbfcb81d6536780637bb621e55c34a2b15N.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:4484
    - - C:\Windows\SysWOW64\Enmjlojd.exe
        
        C:\Windows\system32\Enmjlojd.exe
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4548
      - C:\Windows\SysWOW64\Edionhpn.exe
        
        C:\Windows\system32\Edionhpn.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5212
        
        C:\Windows\SysWOW64\Ekcgkb32.exe
        
        C:\Windows\system32\Ekcgkb32.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:5340
        
        C:\Windows\SysWOW64\Fndpmndl.exe
        
        C:\Windows\system32\Fndpmndl.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5596
        
        C:\Windows\SysWOW64\Filapfbo.exe
        
        C:\Windows\system32\Filapfbo.exe
        9⤵
        Executes dropped EXE
        
        PID:5844
  - - C:\Users\Admin\Downloads\240919-qnzp4azgra_Worm.Win32.Mydoom.pz5851085fd7c81bbd629d3145500cbbea1d499b80a044b5f1f2a736f66d0dd69bN
      C:\Users\Admin\Downloads\240919-qnzp4azgra_Worm.Win32.Mydoom.pz5851085fd7c81bbd629d3145500cbbea1d499b80a044b5f1f2a736f66d0dd69bN
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      PID:4468
    - - C:\Users\Admin\AppData\Local\Temp\services.exe
        
        "C:\Users\Admin\AppData\Local\Temp\services.exe"
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:5448
  - - C:\Users\Admin\Downloads\240919-p8wnhazfqn_80ebb66a5b76ab87390005861b0b534bb838752540188face72be2a2f1364803N.exe
      C:\Users\Admin\Downloads\240919-p8wnhazfqn_80ebb66a5b76ab87390005861b0b534bb838752540188face72be2a2f1364803N.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      PID:5224
    - - C:\Windows\SysWOW64\Fbdehlip.exe
        
        C:\Windows\system32\Fbdehlip.exe
        5⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5944
      - C:\Windows\SysWOW64\Fgcjfbed.exe
        
        C:\Windows\system32\Fgcjfbed.exe
        6⤵
        
        PID:3564
  - - C:\Users\Admin\Downloads\240919-p94eqszgml_48ab527e06366a4e12e140d509afa43cd887cfcf1d9173ffe357441e30bc90f2N.exe
      C:\Users\Admin\Downloads\240919-p94eqszgml_48ab527e06366a4e12e140d509afa43cd887cfcf1d9173ffe357441e30bc90f2N.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:5232
    - - C:\Windows\SysWOW64\Fqgedh32.exe
        
        C:\Windows\system32\Fqgedh32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5980
  - - C:\Users\Admin\Downloads\240919-qbdl4azgrr_6de440eec5ab0e04b83f6501d2efd4b4c52f57f41fb3c9f06d9b0afd960c6021N.exe
      C:\Users\Admin\Downloads\240919-qbdl4azgrr_6de440eec5ab0e04b83f6501d2efd4b4c52f57f41fb3c9f06d9b0afd960c6021N.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      PID:5356
    - - C:\Windows\SysWOW64\Fniihmpf.exe
        
        C:\Windows\system32\Fniihmpf.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5908
      - C:\Windows\SysWOW64\Fgcjfbed.exe
        
        C:\Windows\system32\Fgcjfbed.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1752
  - - C:\Users\Admin\Downloads\240919-qcycwszdja_0f2303b912c2e4071f4fb9e9703c53e7756ab3246dca03f2329304c1c58cd1c2N.exe
      C:\Users\Admin\Downloads\240919-qcycwszdja_0f2303b912c2e4071f4fb9e9703c53e7756ab3246dca03f2329304c1c58cd1c2N.exe
      4⤵
      Modifies visibility of file extensions in Explorer
      Executes dropped EXE
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      System policy modification
      PID:5648
  - - C:\Users\Admin\Downloads\240919-qdam8azhpq_6ed813417e50cef43ce169bf8e48fd96e69ef00b4a32288729a3b25ecfcbed30N.exe
      C:\Users\Admin\Downloads\240919-qdam8azhpq_6ed813417e50cef43ce169bf8e48fd96e69ef00b4a32288729a3b25ecfcbed30N.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:5872
    - - C:\Windows\SysWOW64\Fgcjfbed.exe
        
        C:\Windows\system32\Fgcjfbed.exe
        5⤵
        
        PID:716
  - - C:\Users\Admin\Downloads\240919-qskrqs1are_eb6f29af0991d001e0f39f6b062810b4_JaffaCakes118.exe
      C:\Users\Admin\Downloads\240919-qskrqs1are_eb6f29af0991d001e0f39f6b062810b4_JaffaCakes118.exe
      4⤵
      Adds policy Run key to start application
      Boot or Logon Autostart Execution: Active Setup
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      PID:4552
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        5⤵
        
        PID:4752
    - - C:\Users\Admin\Downloads\240919-qskrqs1are_eb6f29af0991d001e0f39f6b062810b4_JaffaCakes118.exe
        
        "C:\Users\Admin\Downloads\240919-qskrqs1are_eb6f29af0991d001e0f39f6b062810b4_JaffaCakes118.exe"
        5⤵
        
        PID:14316
  - - C:\Users\Admin\Downloads\240919-qtpr3s1gjr_eb7013e136110485304f64a352178c2e_JaffaCakes118.exe
      C:\Users\Admin\Downloads\240919-qtpr3s1gjr_eb7013e136110485304f64a352178c2e_JaffaCakes118.exe
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:5240
  - - C:\Users\Admin\Downloads\240919-p89v5azbmd_0bec6a5d23ec34155a4a5b5c4ae3dcd99e70415da6922b5cfc6aca06fac442bdN.exe
      C:\Users\Admin\Downloads\240919-p89v5azbmd_0bec6a5d23ec34155a4a5b5c4ae3dcd99e70415da6922b5cfc6aca06fac442bdN.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Modifies registry class
      PID:4132
  - - C:\Users\Admin\Downloads\240919-qaykwazcjf_14dfa1ef04263fbaa0dada0a3409b98ada640a9464c5e29f5f42cc68ef07e5c8N.exe
      C:\Users\Admin\Downloads\240919-qaykwazcjf_14dfa1ef04263fbaa0dada0a3409b98ada640a9464c5e29f5f42cc68ef07e5c8N.exe
      4⤵
      Modifies registry class
      PID:1360
    - - C:\Windows\SysWOW64\Hpmhdmea.exe
        
        C:\Windows\system32\Hpmhdmea.exe
        5⤵
        Modifies registry class
        
        PID:4344
      - C:\Windows\SysWOW64\Klndfj32.exe
        
        C:\Windows\system32\Klndfj32.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6116
        
        C:\Windows\SysWOW64\Kidben32.exe
        
        C:\Windows\system32\Kidben32.exe
        7⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5868
        
        C:\Windows\SysWOW64\Kcoccc32.exe
        
        C:\Windows\system32\Kcoccc32.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4612
  - - C:\Users\Admin\Downloads\240919-qjqlma1cjq_eb6960061aadd7275f9b6acf20b20c5b_JaffaCakes118.exe
      C:\Users\Admin\Downloads\240919-qjqlma1cjq_eb6960061aadd7275f9b6acf20b20c5b_JaffaCakes118.exe
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of UnmapMainImage
      PID:5756
    - - C:\Users\Admin\Downloads\240919-qjqlma1cjq_eb6960061aadd7275f9b6acf20b20c5b_JaffaCakes118.exe
        
        C:\Users\Admin\Downloads\240919-qjqlma1cjq_eb6960061aadd7275f9b6acf20b20c5b_JaffaCakes118.exe
        5⤵
        
        PID:5184
  - - C:\Users\Admin\Downloads\240919-qb91aszcpe_eb64dbb7b99cbfe581497232b6c09832_JaffaCakes118.exe
      C:\Users\Admin\Downloads\240919-qb91aszcpe_eb64dbb7b99cbfe581497232b6c09832_JaffaCakes118.exe
      4⤵
      UAC bypass
      Windows security bypass
      Windows security modification
      Checks whether UAC is enabled
      Maps connected drives based on registry
      Suspicious use of SetThreadContext
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      System policy modification
      PID:5920
    - - C:\Users\Admin\Downloads\240919-qb91aszcpe_eb64dbb7b99cbfe581497232b6c09832_JaffaCakes118.exe
        
        "C:\Users\Admin\Downloads\240919-qb91aszcpe_eb64dbb7b99cbfe581497232b6c09832_JaffaCakes118.exe"
        5⤵
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:5824
      - C:\Users\Admin\Downloads\240919-qb91aszcpe_eb64dbb7b99cbfe581497232b6c09832_JaffaCakes118.exe
        
        C:\Users\Admin\Downloads\240919-qb91aszcpe_eb64dbb7b99cbfe581497232b6c09832_JaffaCakes118.exe
        6⤵
        
        PID:1276
    - - C:\Users\Admin\Downloads\240919-qb91aszcpe_eb64dbb7b99cbfe581497232b6c09832_JaffaCakes118.exe
        
        "C:\Users\Admin\Downloads\240919-qb91aszcpe_eb64dbb7b99cbfe581497232b6c09832_JaffaCakes118.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2460
  - - C:\Users\Admin\Downloads\240919-qktpnszfnh_44c2bc170fd3a4981a56fccdc449ad90b646b0d71c1793824fcfe28f36aea697N.exe
      C:\Users\Admin\Downloads\240919-qktpnszfnh_44c2bc170fd3a4981a56fccdc449ad90b646b0d71c1793824fcfe28f36aea697N.exe
      4⤵
      Modifies visibility of file extensions in Explorer
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      System policy modification
      PID:6048
  - - C:\Users\Admin\Downloads\240919-qaah2szbqg_bf16782f1bb5625296e22bb444aac8d330b03cdfc73f4e8d0a22e9daf77cbf40N.exe
      C:\Users\Admin\Downloads\240919-qaah2szbqg_bf16782f1bb5625296e22bb444aac8d330b03cdfc73f4e8d0a22e9daf77cbf40N.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Modifies registry class
      PID:3980
    - - C:\Windows\SysWOW64\Kiphjo32.exe
        
        C:\Windows\system32\Kiphjo32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5964
      - C:\Windows\SysWOW64\Kidben32.exe
        
        C:\Windows\system32\Kidben32.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3380
        
        C:\Windows\SysWOW64\Kcoccc32.exe
        
        C:\Windows\system32\Kcoccc32.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3564
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3564 -s 412
        8⤵
        Program crash
        
        PID:7320
  - - C:\Users\Admin\Downloads\240919-p8q31szfpp_Backdoor.Win32.Berbew.AA.MTB90cc4bc0699dcaf31f7d42ef592904c7641ac7d81f2038768f3a4056d91634fcN
      C:\Users\Admin\Downloads\240919-p8q31szfpp_Backdoor.Win32.Berbew.AA.MTB90cc4bc0699dcaf31f7d42ef592904c7641ac7d81f2038768f3a4056d91634fcN
      4⤵
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:5608
    - - C:\Windows\SysWOW64\Lcfidb32.exe
        
        C:\Windows\system32\Lcfidb32.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1752
      - C:\Windows\SysWOW64\Mapppn32.exe
        
        C:\Windows\system32\Mapppn32.exe
        6⤵
        
        PID:836
        
        C:\Windows\SysWOW64\Mfenglqf.exe
        
        C:\Windows\system32\Mfenglqf.exe
        7⤵
        
        PID:4276
        
        C:\Windows\SysWOW64\Njedbjej.exe
        
        C:\Windows\system32\Njedbjej.exe
        8⤵
        
        PID:3816
        
        C:\Windows\SysWOW64\Objkmkjj.exe
        
        C:\Windows\system32\Objkmkjj.exe
        9⤵
        
        PID:6316
        
        C:\Windows\SysWOW64\Ppnenlka.exe
        
        C:\Windows\system32\Ppnenlka.exe
        10⤵
        
        PID:7228
        
        C:\Windows\SysWOW64\Dahfkimd.exe
        
        C:\Windows\system32\Dahfkimd.exe
        11⤵
        
        PID:10324
        
        C:\Windows\SysWOW64\Gkcigjel.exe
        
        C:\Windows\system32\Gkcigjel.exe
        12⤵
        
        PID:12188
  - - C:\Users\Admin\Downloads\240919-qd545a1ajm_Backdoor.Win32.Berbew.AA.MTB-30a8a70336c6f59adf4b8a0f7eb6c0206623fb7fa9c2509ca3cf5840814921a5N
      C:\Users\Admin\Downloads\240919-qd545a1ajm_Backdoor.Win32.Berbew.AA.MTB-30a8a70336c6f59adf4b8a0f7eb6c0206623fb7fa9c2509ca3cf5840814921a5N
      4⤵
      Drops file in System32 directory
      Modifies registry class
      PID:5420
    - - C:\Windows\SysWOW64\Lhcali32.exe
        
        C:\Windows\system32\Lhcali32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5180
      - C:\Windows\SysWOW64\Lplfcf32.exe
        
        C:\Windows\system32\Lplfcf32.exe
        6⤵
        
        PID:3728
  - - C:\Users\Admin\Downloads\240919-qlayys1cqm_eb6a663833d81c3fb6ec63f1b32b19ee_JaffaCakes118.exe
      C:\Users\Admin\Downloads\240919-qlayys1cqm_eb6a663833d81c3fb6ec63f1b32b19ee_JaffaCakes118.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3452
  - - C:\Users\Admin\Downloads\240919-qtg28s1bma_868a73b91e83b4c61e40207e8b616dab74e14136d886efab1f591348fcf47200N.exe
      C:\Users\Admin\Downloads\240919-qtg28s1bma_868a73b91e83b4c61e40207e8b616dab74e14136d886efab1f591348fcf47200N.exe
      4⤵
      PID:5856
    - - \??\c:\jvdvp.exe
        
        c:\jvdvp.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5908
      - \??\c:\9vvjv.exe
        
        c:\9vvjv.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4112
        
        \??\c:\ffrlfff.exe
        
        c:\ffrlfff.exe
        7⤵
        
        PID:2848
        
        \??\c:\vjvjj.exe
        
        c:\vjvjj.exe
        8⤵
        
        PID:1632
        
        \??\c:\btnbtn.exe
        
        c:\btnbtn.exe
        9⤵
        
        PID:6260
        
        \??\c:\5rrlffr.exe
        
        c:\5rrlffr.exe
        10⤵
        
        PID:5224
        
        \??\c:\rxxlfrf.exe
        
        c:\rxxlfrf.exe
        11⤵
        
        PID:7800
        
        \??\c:\1bbthh.exe
        
        c:\1bbthh.exe
        12⤵
        
        PID:6964
        
        \??\c:\nhnhbt.exe
        
        c:\nhnhbt.exe
        13⤵
        
        PID:13168
        
        \??\c:\xlxlxxl.exe
        
        c:\xlxlxxl.exe
        14⤵
        
        PID:13780
        
        \??\c:\ttnhbb.exe
        
        c:\ttnhbb.exe
        15⤵
        
        PID:15068
        
        \??\c:\3bbbbt.exe
        
        c:\3bbbbt.exe
        16⤵
        
        PID:6820
        
        \??\c:\httbtn.exe
        
        c:\httbtn.exe
        17⤵
        
        PID:13884
  - - C:\Users\Admin\Downloads\240919-qt4k8s1glq_19dab265f48a2fc83ee2411287d5509106326c5c8ffa74cb5befdc5f01b38dc9N.exe
      C:\Users\Admin\Downloads\240919-qt4k8s1glq_19dab265f48a2fc83ee2411287d5509106326c5c8ffa74cb5befdc5f01b38dc9N.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Drops file in System32 directory
      Modifies registry class
      PID:5596
    - - C:\Windows\SysWOW64\Laiipofp.exe
        
        C:\Windows\system32\Laiipofp.exe
        5⤵
        
        PID:5016
      - C:\Windows\SysWOW64\Mfkkqmiq.exe
        
        C:\Windows\system32\Mfkkqmiq.exe
        6⤵
        
        PID:5128
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5128 -s 380
        7⤵
        Program crash
        
        PID:7304
  - - C:\Users\Admin\Downloads\240919-qkynmazfpc_5de5302fd91cc380c3c47da4b685565874bd2340910cf1362e7b5feec3ae95cdN.exe
      C:\Users\Admin\Downloads\240919-qkynmazfpc_5de5302fd91cc380c3c47da4b685565874bd2340910cf1362e7b5feec3ae95cdN.exe
      4⤵
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      PID:2348
    - - C:\Windows\SysWOW64\Lojmcdgl.exe
        
        C:\Windows\system32\Lojmcdgl.exe
        5⤵
        
        PID:5720
      - C:\Windows\SysWOW64\Mfkkqmiq.exe
        
        C:\Windows\system32\Mfkkqmiq.exe
        6⤵
        
        PID:1216
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1216 -s 408
        7⤵
        Program crash
        
        PID:7420
  - - C:\Users\Admin\Downloads\240919-p81bpazfrj_72369386d9596ace4950517c7ef51e300c59cac1cf9c46c0fb9ff95a4a9f51dbN.exe
      C:\Users\Admin\Downloads\240919-p81bpazfrj_72369386d9596ace4950517c7ef51e300c59cac1cf9c46c0fb9ff95a4a9f51dbN.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:404
    - - C:\Windows\SysWOW64\Ljbnfleo.exe
        
        C:\Windows\system32\Ljbnfleo.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4036
  - - C:\Users\Admin\Downloads\240919-qr69ca1apg_4d371c6d7e98117f621806dbcd7035761210de59a485acfc42e95fee38fd2d56.exe
      C:\Users\Admin\Downloads\240919-qr69ca1apg_4d371c6d7e98117f621806dbcd7035761210de59a485acfc42e95fee38fd2d56.exe
      4⤵
      PID:4760
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\240919-qr69ca1apg_4d371c6d7e98117f621806dbcd7035761210de59a485acfc42e95fee38fd2d56"
        5⤵
        
        PID:2564
      - C:\Users\Admin\Downloads\240919-qr69ca1apg_4d371c6d7e98117f621806dbcd7035761210de59a485acfc42e95fee38fd2d56.exe
        
        C:\Users\Admin\Downloads\240919-qr69ca1apg_4d371c6d7e98117f621806dbcd7035761210de59a485acfc42e95fee38fd2d56
        6⤵
        
        PID:5308
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        5⤵
        Modifies registry key
        
        PID:4028
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        5⤵
        Modifies registry key
        
        PID:6124
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        5⤵
        Modifies registry key
        
        PID:2972
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\HQwEwcIg.bat" "C:\Users\Admin\Downloads\240919-qr69ca1apg_4d371c6d7e98117f621806dbcd7035761210de59a485acfc42e95fee38fd2d56.exe""
        5⤵
        
        PID:6064
  - - C:\Users\Admin\Downloads\240919-p77z5szbjf_9a8117dcaa29217f7d866872318a53261c2468c0f50263109bc6c22731885ea6N.exe
      C:\Users\Admin\Downloads\240919-p77z5szbjf_9a8117dcaa29217f7d866872318a53261c2468c0f50263109bc6c22731885ea6N.exe
      4⤵
      PID:2176
  - - C:\Users\Admin\Downloads\240919-qsg1va1fpn_175eef9d21b6de3704164fb14af814441aff30c859c34acd58255eb602451a7bN.exe
      C:\Users\Admin\Downloads\240919-qsg1va1fpn_175eef9d21b6de3704164fb14af814441aff30c859c34acd58255eb602451a7bN.exe
      4⤵
      PID:2168
    - - \??\c:\rllxxrl.exe
        
        c:\rllxxrl.exe
        5⤵
        
        PID:4364
      - \??\c:\pvvpj.exe
        
        c:\pvvpj.exe
        6⤵
        
        PID:4800
        
        \??\c:\vvvvj.exe
        
        c:\vvvvj.exe
        7⤵
        
        PID:4020
        
        \??\c:\lfrfrfx.exe
        
        c:\lfrfrfx.exe
        8⤵
        
        PID:6484
        
        \??\c:\jpppj.exe
        
        c:\jpppj.exe
        9⤵
        
        PID:2932
        
        \??\c:\7rlxrfr.exe
        
        c:\7rlxrfr.exe
        10⤵
        
        PID:9288
        
        \??\c:\3vdjd.exe
        
        c:\3vdjd.exe
        11⤵
        
        PID:10292
        
        \??\c:\xrrrfxl.exe
        
        c:\xrrrfxl.exe
        12⤵
        
        PID:12280
        
        \??\c:\5xxrltn.exe
        
        c:\5xxrltn.exe
        13⤵
        
        PID:14304
        
        \??\c:\dpjvp.exe
        
        c:\dpjvp.exe
        14⤵
        
        PID:15828
        
        \??\c:\xffrlfx.exe
        
        c:\xffrlfx.exe
        15⤵
        
        PID:14060
        
        \??\c:\btbtbt.exe
        
        c:\btbtbt.exe
        16⤵
        
        PID:10424
        
        \??\c:\hbthbh.exe
        
        c:\hbthbh.exe
        17⤵
        
        PID:17656
  - - C:\Users\Admin\Downloads\240919-p9f97szgjn_eb6316e2db30d6d6f9b426ac3216c170_JaffaCakes118.exe
      C:\Users\Admin\Downloads\240919-p9f97szgjn_eb6316e2db30d6d6f9b426ac3216c170_JaffaCakes118.exe
      4⤵
      PID:1284
  - - C:\Users\Admin\Downloads\240919-qq6w7a1ern_2eb677d7ba4c1cb0a90f0eb7b81847c672b4660bccef5c5f9872853b7065c281N.exe
      C:\Users\Admin\Downloads\240919-qq6w7a1ern_2eb677d7ba4c1cb0a90f0eb7b81847c672b4660bccef5c5f9872853b7065c281N.exe
      4⤵
      PID:6128
    - - C:\Windows\SysWOW64\Mlljnf32.exe
        
        C:\Windows\system32\Mlljnf32.exe
        5⤵
        
        PID:1624
      - C:\Windows\SysWOW64\Nbnlaldg.exe
        
        C:\Windows\system32\Nbnlaldg.exe
        6⤵
        
        PID:4996
        
        C:\Windows\SysWOW64\Ofjqihnn.exe
        
        C:\Windows\system32\Ofjqihnn.exe
        7⤵
        
        PID:6596
        
        C:\Windows\SysWOW64\Cmgqpkip.exe
        
        C:\Windows\system32\Cmgqpkip.exe
        8⤵
        
        PID:3316
        
        C:\Windows\SysWOW64\Enhifi32.exe
        
        C:\Windows\system32\Enhifi32.exe
        9⤵
        
        PID:7552
        
        C:\Windows\SysWOW64\Fcbnpnme.exe
        
        C:\Windows\system32\Fcbnpnme.exe
        10⤵
        
        PID:6308
        
        C:\Windows\SysWOW64\Hnhkdd32.exe
        
        C:\Windows\system32\Hnhkdd32.exe
        11⤵
        
        PID:12656
        
        C:\Windows\SysWOW64\Jhoeef32.exe
        
        C:\Windows\system32\Jhoeef32.exe
        12⤵
        
        PID:11172
        
        C:\Windows\SysWOW64\Leabphmp.exe
        
        C:\Windows\system32\Leabphmp.exe
        13⤵
        
        PID:11808
        
        C:\Windows\SysWOW64\Mdghhb32.exe
        
        C:\Windows\system32\Mdghhb32.exe
        14⤵
        
        PID:16084
        
        C:\Windows\SysWOW64\Ocdgahag.exe
        
        C:\Windows\system32\Ocdgahag.exe
        15⤵
        
        PID:12788
        
        C:\Windows\SysWOW64\Pfeijqqe.exe
        
        C:\Windows\system32\Pfeijqqe.exe
        16⤵
        
        PID:15492
        
        C:\Windows\SysWOW64\Blgddd32.exe
        
        C:\Windows\system32\Blgddd32.exe
        17⤵
        
        PID:18344
  - - C:\Users\Admin\Downloads\240919-qlnj2s1crp_279d22f294ac334c59e14c4f2ebd4b5bf55d1af19f5d99286c7850cdca4c37bbN.exe
      C:\Users\Admin\Downloads\240919-qlnj2s1crp_279d22f294ac334c59e14c4f2ebd4b5bf55d1af19f5d99286c7850cdca4c37bbN.exe
      4⤵
      PID:5432
    - - C:\Windows\SysWOW64\Nfnamjhk.exe
        
        C:\Windows\system32\Nfnamjhk.exe
        5⤵
        
        PID:1820
      - C:\Windows\SysWOW64\Oiagde32.exe
        
        C:\Windows\system32\Oiagde32.exe
        6⤵
        
        PID:5480
        
        C:\Windows\SysWOW64\Pjoppf32.exe
        
        C:\Windows\system32\Pjoppf32.exe
        7⤵
        
        PID:5408
        
        C:\Windows\SysWOW64\Cdaile32.exe
        
        C:\Windows\system32\Cdaile32.exe
        8⤵
        
        PID:8588
        
        C:\Windows\SysWOW64\Eaceghcg.exe
        
        C:\Windows\system32\Eaceghcg.exe
        9⤵
        
        PID:7136
        
        C:\Windows\SysWOW64\Fkjfakng.exe
        
        C:\Windows\system32\Fkjfakng.exe
        10⤵
        
        PID:9080
        
        C:\Windows\SysWOW64\Hegmlnbp.exe
        
        C:\Windows\system32\Hegmlnbp.exe
        11⤵
        
        PID:13112
        
        C:\Windows\SysWOW64\Kkegbpca.exe
        
        C:\Windows\system32\Kkegbpca.exe
        12⤵
        
        PID:14936
        
        C:\Windows\SysWOW64\Ofbdncaj.exe
        
        C:\Windows\system32\Ofbdncaj.exe
        13⤵
        
        PID:8712
        
        C:\Windows\SysWOW64\Pmeoqlpl.exe
        
        C:\Windows\system32\Pmeoqlpl.exe
        14⤵
        
        PID:12736
        
        C:\Windows\SysWOW64\Qfjcep32.exe
        
        C:\Windows\system32\Qfjcep32.exe
        15⤵
        
        PID:16724
  - - C:\Users\Admin\Downloads\240919-qperbazhkb_Worm.Win32.Vobfus.EQ2f38f3e5ff93dda7b69a76c5851830e28882d8db55c9ceac4413734010dd1b0aN
      C:\Users\Admin\Downloads\240919-qperbazhkb_Worm.Win32.Vobfus.EQ2f38f3e5ff93dda7b69a76c5851830e28882d8db55c9ceac4413734010dd1b0aN
      4⤵
      PID:5932
    - - C:\Users\Admin\kiuuy.exe
        
        "C:\Users\Admin\kiuuy.exe"
        5⤵
        
        PID:19092
  - - C:\Users\Admin\Downloads\240919-qqfp1azhqc_2024-09-19_620450c2a14e70c96011b896f802b2df_bkransomware.exe
      C:\Users\Admin\Downloads\240919-qqfp1azhqc_2024-09-19_620450c2a14e70c96011b896f802b2df_bkransomware.exe
      4⤵
      PID:3540
  - - C:\Users\Admin\Downloads\240919-qp6j2azhng_ccf50c0ef636d6427c89d41e5939b419422fc487d6aeb0cb825fe6ca2f1fba4cN.exe
      C:\Users\Admin\Downloads\240919-qp6j2azhng_ccf50c0ef636d6427c89d41e5939b419422fc487d6aeb0cb825fe6ca2f1fba4cN.exe
      4⤵
      PID:5272
    - - C:\Windows\SysWOW64\Nimmifgo.exe
        
        C:\Windows\system32\Nimmifgo.exe
        5⤵
        
        PID:1636
      - C:\Windows\SysWOW64\Ommceclc.exe
        
        C:\Windows\system32\Ommceclc.exe
        6⤵
        
        PID:6188
        
        C:\Windows\SysWOW64\Obnehj32.exe
        
        C:\Windows\system32\Obnehj32.exe
        7⤵
        
        PID:6560
        
        C:\Windows\SysWOW64\Cmgqpkip.exe
        
        C:\Windows\system32\Cmgqpkip.exe
        8⤵
        
        PID:8408
        
        C:\Windows\SysWOW64\Fbaahf32.exe
        
        C:\Windows\system32\Fbaahf32.exe
        9⤵
        
        PID:8472
        
        C:\Windows\SysWOW64\Jddiegbm.exe
        
        C:\Windows\system32\Jddiegbm.exe
        10⤵
        
        PID:9604
        
        C:\Windows\SysWOW64\Mahklf32.exe
        
        C:\Windows\system32\Mahklf32.exe
        11⤵
        
        PID:16028
        
        C:\Windows\SysWOW64\Ohncdobq.exe
        
        C:\Windows\system32\Ohncdobq.exe
        12⤵
        
        PID:15616
        
        C:\Windows\SysWOW64\Pfbmdabh.exe
        
        C:\Windows\system32\Pfbmdabh.exe
        13⤵
        
        PID:12664
        
        C:\Windows\SysWOW64\Bclppboi.exe
        
        C:\Windows\system32\Bclppboi.exe
        14⤵
        
        PID:18084
        
        C:\Windows\SysWOW64\Dgdgijhp.exe
        
        C:\Windows\system32\Dgdgijhp.exe
        15⤵
        
        PID:17688
        
        C:\Windows\SysWOW64\Epaemojk.exe
        
        C:\Windows\system32\Epaemojk.exe
        16⤵
        
        PID:17592
        
        C:\Windows\SysWOW64\Fgncff32.exe
        
        C:\Windows\system32\Fgncff32.exe
        17⤵
        
        PID:19136
        
        C:\Windows\SysWOW64\Hnjaonij.exe
        
        C:\Windows\system32\Hnjaonij.exe
        18⤵
        
        PID:13756
        
        C:\Windows\SysWOW64\Hgebnc32.exe
        
        C:\Windows\system32\Hgebnc32.exe
        19⤵
        
        PID:15236
        
        C:\Windows\SysWOW64\Inagpm32.exe
        
        C:\Windows\system32\Inagpm32.exe
        20⤵
        
        PID:18820
        
        C:\Windows\SysWOW64\Ijjekn32.exe
        
        C:\Windows\system32\Ijjekn32.exe
        21⤵
        
        PID:18576
  - - C:\Users\Admin\Downloads\240919-qcj59szcqd_eb6510fcd1c1538b2a760031b214832a_JaffaCakes118.exe
      C:\Users\Admin\Downloads\240919-qcj59szcqd_eb6510fcd1c1538b2a760031b214832a_JaffaCakes118.exe
      4⤵
      PID:5872
  - - C:\Users\Admin\Downloads\240919-qpx8na1eml_eb6d07bb05af763fb8b852e73d4aa5b2_JaffaCakes118.exe
      C:\Users\Admin\Downloads\240919-qpx8na1eml_eb6d07bb05af763fb8b852e73d4aa5b2_JaffaCakes118.exe
      4⤵
      PID:1092
    - - C:\Users\Admin\Downloads\240919-qpx8na1eml_eb6d07bb05af763fb8b852e73d4aa5b2_JaffaCakes118.exe
        
        C:\Users\Admin\Downloads\240919-qpx8na1eml_eb6d07bb05af763fb8b852e73d4aa5b2_JaffaCakes118.exe
        5⤵
        
        PID:6440
      - C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        6⤵
        
        PID:11328
  - - C:\Users\Admin\Downloads\240919-qmtsfs1dmp_97135bc50f77a5e87f8b1f574974260e7257f4bcb977b720bfe5ae76b4e0898eN.exe
      C:\Users\Admin\Downloads\240919-qmtsfs1dmp_97135bc50f77a5e87f8b1f574974260e7257f4bcb977b720bfe5ae76b4e0898eN.exe
      4⤵
      PID:5968
    - - C:\Users\Admin\Admin.exe
        
        "C:\Users\Admin\Admin.exe"
        5⤵
        
        PID:15952
  - - C:\Users\Admin\Downloads\240919-p8bnbszbka_51eb0c77b634a954f4e52b3b678d7a8e982137f04012116976472326dd518e1bN.exe
      C:\Users\Admin\Downloads\240919-p8bnbszbka_51eb0c77b634a954f4e52b3b678d7a8e982137f04012116976472326dd518e1bN.exe
      4⤵
      PID:6028
    - - C:\Windows\SysWOW64\Nqcejcha.exe
        
        C:\Windows\system32\Nqcejcha.exe
        5⤵
        
        PID:1716
      - C:\Windows\SysWOW64\Oqhoeb32.exe
        
        C:\Windows\system32\Oqhoeb32.exe
        6⤵
        
        PID:6220
        
        C:\Windows\SysWOW64\Ojemig32.exe
        
        C:\Windows\system32\Ojemig32.exe
        7⤵
        
        PID:6628
        
        C:\Windows\SysWOW64\Pbjddh32.exe
        
        C:\Windows\system32\Pbjddh32.exe
        8⤵
        
        PID:9752
        
        C:\Windows\SysWOW64\Egegjn32.exe
        
        C:\Windows\system32\Egegjn32.exe
        9⤵
        
        PID:10752
        
        C:\Windows\SysWOW64\Gbhhieao.exe
        
        C:\Windows\system32\Gbhhieao.exe
        10⤵
        
        PID:11640
        
        C:\Windows\SysWOW64\Hnbnjc32.exe
        
        C:\Windows\system32\Hnbnjc32.exe
        11⤵
        
        PID:9428
        
        C:\Windows\SysWOW64\Jbijgp32.exe
        
        C:\Windows\system32\Jbijgp32.exe
        12⤵
        
        PID:14108
        
        C:\Windows\SysWOW64\Loemnnhe.exe
        
        C:\Windows\system32\Loemnnhe.exe
        13⤵
        
        PID:11496
        
        C:\Windows\SysWOW64\Mhpgca32.exe
        
        C:\Windows\system32\Mhpgca32.exe
        14⤵
        
        PID:15868
        
        C:\Windows\SysWOW64\Nfpghccm.exe
        
        C:\Windows\system32\Nfpghccm.exe
        15⤵
        
        PID:14000
        
        C:\Windows\SysWOW64\Poidhg32.exe
        
        C:\Windows\system32\Poidhg32.exe
        16⤵
        
        PID:10068
  - - C:\Users\Admin\Downloads\240919-qa75bazckf_HackTool.Win32.CobaltStrike.pz-2d492c101f07986483dc135e690a80fa088c999a38dde968bf846c5de0fb3fe3N
      C:\Users\Admin\Downloads\240919-qa75bazckf_HackTool.Win32.CobaltStrike.pz-2d492c101f07986483dc135e690a80fa088c999a38dde968bf846c5de0fb3fe3N
      4⤵
      PID:5684
    - - C:\Windows\System\OTioFBD.exe
        
        C:\Windows\System\OTioFBD.exe
        5⤵
        
        PID:6844
    - - C:\Windows\System\tTVuBIJ.exe
        
        C:\Windows\System\tTVuBIJ.exe
        5⤵
        
        PID:6880
    - - C:\Windows\System\alatyTi.exe
        
        C:\Windows\System\alatyTi.exe
        5⤵
        
        PID:6900
    - - C:\Windows\System\AstDQOe.exe
        
        C:\Windows\System\AstDQOe.exe
        5⤵
        
        PID:6916
    - - C:\Windows\System\tepVaOk.exe
        
        C:\Windows\System\tepVaOk.exe
        5⤵
        
        PID:6952
    - - C:\Windows\System\gyFHAcn.exe
        
        C:\Windows\System\gyFHAcn.exe
        5⤵
        
        PID:6968
    - - C:\Windows\System\vnYXdUW.exe
        
        C:\Windows\System\vnYXdUW.exe
        5⤵
        
        PID:6988
    - - C:\Windows\System\jsFMXvd.exe
        
        C:\Windows\System\jsFMXvd.exe
        5⤵
        
        PID:7004
    - - C:\Windows\System\GJdPHNa.exe
        
        C:\Windows\System\GJdPHNa.exe
        5⤵
        
        PID:7020
    - - C:\Windows\System\DYGyFeG.exe
        
        C:\Windows\System\DYGyFeG.exe
        5⤵
        
        PID:7040
    - - C:\Windows\System\kwWBOzV.exe
        
        C:\Windows\System\kwWBOzV.exe
        5⤵
        
        PID:7056
    - - C:\Windows\System\iIuxPIt.exe
        
        C:\Windows\System\iIuxPIt.exe
        5⤵
        
        PID:7076
    - - C:\Windows\System\ZhioouU.exe
        
        C:\Windows\System\ZhioouU.exe
        5⤵
        
        PID:7096
    - - C:\Windows\System\WECeRpF.exe
        
        C:\Windows\System\WECeRpF.exe
        5⤵
        
        PID:7128
    - - C:\Windows\System\ZldtuFp.exe
        
        C:\Windows\System\ZldtuFp.exe
        5⤵
        
        PID:7156
    - - C:\Windows\System\bAmJLHK.exe
        
        C:\Windows\System\bAmJLHK.exe
        5⤵
        
        PID:3628
    - - C:\Windows\System\RGGtIsu.exe
        
        C:\Windows\System\RGGtIsu.exe
        5⤵
        
        PID:4344
    - - C:\Windows\System\IRVJFXc.exe
        
        C:\Windows\System\IRVJFXc.exe
        5⤵
        
        PID:4888
    - - C:\Windows\System\rhfqZVv.exe
        
        C:\Windows\System\rhfqZVv.exe
        5⤵
        
        PID:4760
    - - C:\Windows\System\GbyFdiF.exe
        
        C:\Windows\System\GbyFdiF.exe
        5⤵
        
        PID:5148
    - - C:\Windows\System\fqSCMeN.exe
        
        C:\Windows\System\fqSCMeN.exe
        5⤵
        
        PID:3428
    - - C:\Windows\System\lBKVuKJ.exe
        
        C:\Windows\System\lBKVuKJ.exe
        5⤵
        
        PID:5548
    - - C:\Windows\System\sarCUxm.exe
        
        C:\Windows\System\sarCUxm.exe
        5⤵
        
        PID:2848
    - - C:\Windows\System\cRtqCOs.exe
        
        C:\Windows\System\cRtqCOs.exe
        5⤵
        
        PID:3988
    - - C:\Windows\System\ZkwOfZH.exe
        
        C:\Windows\System\ZkwOfZH.exe
        5⤵
        
        PID:6140
    - - C:\Windows\System\qEBaHCY.exe
        
        C:\Windows\System\qEBaHCY.exe
        5⤵
        
        PID:1544
    - - C:\Windows\System\FmhUAQn.exe
        
        C:\Windows\System\FmhUAQn.exe
        5⤵
        
        PID:2280
    - - C:\Windows\System\htTwXRx.exe
        
        C:\Windows\System\htTwXRx.exe
        5⤵
        
        PID:3188
    - - C:\Windows\System\eCNdGvp.exe
        
        C:\Windows\System\eCNdGvp.exe
        5⤵
        
        PID:940
    - - C:\Windows\System\EORsVoZ.exe
        
        C:\Windows\System\EORsVoZ.exe
        5⤵
        
        PID:2808
    - - C:\Windows\System\TWypOlO.exe
        
        C:\Windows\System\TWypOlO.exe
        5⤵
        
        PID:5048
    - - C:\Windows\System\rDUIuwh.exe
        
        C:\Windows\System\rDUIuwh.exe
        5⤵
        
        PID:6184
    - - C:\Windows\System\DEhuHnf.exe
        
        C:\Windows\System\DEhuHnf.exe
        5⤵
        
        PID:6268
    - - C:\Windows\System\RQoTQed.exe
        
        C:\Windows\System\RQoTQed.exe
        5⤵
        
        PID:7208
    - - C:\Windows\System\KgutbCs.exe
        
        C:\Windows\System\KgutbCs.exe
        5⤵
        
        PID:7248
    - - C:\Windows\System\PfEyMth.exe
        
        C:\Windows\System\PfEyMth.exe
        5⤵
        
        PID:7288
    - - C:\Windows\System\slcEIsr.exe
        
        C:\Windows\System\slcEIsr.exe
        5⤵
        
        PID:7344
    - - C:\Windows\System\MlBOmiV.exe
        
        C:\Windows\System\MlBOmiV.exe
        5⤵
        
        PID:7360
    - - C:\Windows\System\gpnLdzH.exe
        
        C:\Windows\System\gpnLdzH.exe
        5⤵
        
        PID:7380
    - - C:\Windows\System\xdBWfTG.exe
        
        C:\Windows\System\xdBWfTG.exe
        5⤵
        
        PID:7400
    - - C:\Windows\System\WRjCdNE.exe
        
        C:\Windows\System\WRjCdNE.exe
        5⤵
        
        PID:7444
    - - C:\Windows\System\EjbMVbp.exe
        
        C:\Windows\System\EjbMVbp.exe
        5⤵
        
        PID:7464
    - - C:\Windows\System\mjEvQrN.exe
        
        C:\Windows\System\mjEvQrN.exe
        5⤵
        
        PID:7616
    - - C:\Windows\System\ULXZXmF.exe
        
        C:\Windows\System\ULXZXmF.exe
        5⤵
        
        PID:7016
    - - C:\Windows\System\TVQBGFG.exe
        
        C:\Windows\System\TVQBGFG.exe
        5⤵
        
        PID:8432
    - - C:\Windows\System\VfNvPCl.exe
        
        C:\Windows\System\VfNvPCl.exe
        5⤵
        
        PID:8448
    - - C:\Windows\System\LEVDYXm.exe
        
        C:\Windows\System\LEVDYXm.exe
        5⤵
        
        PID:8464
    - - C:\Windows\System\yxgEtZd.exe
        
        C:\Windows\System\yxgEtZd.exe
        5⤵
        
        PID:8496
    - - C:\Windows\System\AISDExN.exe
        
        C:\Windows\System\AISDExN.exe
        5⤵
        
        PID:8516
    - - C:\Windows\System\atWGxqQ.exe
        
        C:\Windows\System\atWGxqQ.exe
        5⤵
        
        PID:8540
    - - C:\Windows\System\OJIHrDK.exe
        
        C:\Windows\System\OJIHrDK.exe
        5⤵
        
        PID:8564
    - - C:\Windows\System\QDbETso.exe
        
        C:\Windows\System\QDbETso.exe
        5⤵
        
        PID:8580
    - - C:\Windows\System\vHXGjTD.exe
        
        C:\Windows\System\vHXGjTD.exe
        5⤵
        
        PID:8596
    - - C:\Windows\System\LATLBXS.exe
        
        C:\Windows\System\LATLBXS.exe
        5⤵
        
        PID:8612
    - - C:\Windows\System\ArMveRe.exe
        
        C:\Windows\System\ArMveRe.exe
        5⤵
        
        PID:8852
    - - C:\Windows\System\zoYrPTh.exe
        
        C:\Windows\System\zoYrPTh.exe
        5⤵
        
        PID:8868
    - - C:\Windows\System\pKuZqpn.exe
        
        C:\Windows\System\pKuZqpn.exe
        5⤵
        
        PID:8884
    - - C:\Windows\System\AGTkmwp.exe
        
        C:\Windows\System\AGTkmwp.exe
        5⤵
        
        PID:8900
    - - C:\Windows\System\PxpaxCp.exe
        
        C:\Windows\System\PxpaxCp.exe
        5⤵
        
        PID:8932
    - - C:\Windows\System\YhYUQrP.exe
        
        C:\Windows\System\YhYUQrP.exe
        5⤵
        
        PID:8948
    - - C:\Windows\System\ehLBJDg.exe
        
        C:\Windows\System\ehLBJDg.exe
        5⤵
        
        PID:8976
    - - C:\Windows\System\aZWbZbo.exe
        
        C:\Windows\System\aZWbZbo.exe
        5⤵
        
        PID:9004
    - - C:\Windows\System\ouMbaem.exe
        
        C:\Windows\System\ouMbaem.exe
        5⤵
        
        PID:9024
    - - C:\Windows\System\oAZAkpA.exe
        
        C:\Windows\System\oAZAkpA.exe
        5⤵
        
        PID:9040
    - - C:\Windows\System\hUrEBAK.exe
        
        C:\Windows\System\hUrEBAK.exe
        5⤵
        
        PID:9060
    - - C:\Windows\System\WvFwuvx.exe
        
        C:\Windows\System\WvFwuvx.exe
        5⤵
        
        PID:9084
    - - C:\Windows\System\rbGKyZk.exe
        
        C:\Windows\System\rbGKyZk.exe
        5⤵
        
        PID:9104
    - - C:\Windows\System\KkTkkSj.exe
        
        C:\Windows\System\KkTkkSj.exe
        5⤵
        
        PID:9144
    - - C:\Windows\System\CXNfcQl.exe
        
        C:\Windows\System\CXNfcQl.exe
        5⤵
        
        PID:9172
    - - C:\Windows\System\eTgdUjy.exe
        
        C:\Windows\System\eTgdUjy.exe
        5⤵
        
        PID:9200
    - - C:\Windows\System\yIQVUjx.exe
        
        C:\Windows\System\yIQVUjx.exe
        5⤵
        
        PID:6996
    - - C:\Windows\System\ESSlUlK.exe
        
        C:\Windows\System\ESSlUlK.exe
        5⤵
        
        PID:7104
    - - C:\Windows\System\ApuuhJn.exe
        
        C:\Windows\System\ApuuhJn.exe
        5⤵
        
        PID:2152
    - - C:\Windows\System\rJgsMEd.exe
        
        C:\Windows\System\rJgsMEd.exe
        5⤵
        
        PID:228
    - - C:\Windows\System\nZrULVx.exe
        
        C:\Windows\System\nZrULVx.exe
        5⤵
        
        PID:7692
    - - C:\Windows\System\bYHjsOu.exe
        
        C:\Windows\System\bYHjsOu.exe
        5⤵
        
        PID:3692
    - - C:\Windows\System\OQKqabt.exe
        
        C:\Windows\System\OQKqabt.exe
        5⤵
        
        PID:7084
    - - C:\Windows\System\atwZOIE.exe
        
        C:\Windows\System\atwZOIE.exe
        5⤵
        
        PID:5252
    - - C:\Windows\System\hjXsFXH.exe
        
        C:\Windows\System\hjXsFXH.exe
        5⤵
        
        PID:5508
    - - C:\Windows\System\sTuwbYn.exe
        
        C:\Windows\System\sTuwbYn.exe
        5⤵
        
        PID:5132
    - - C:\Windows\System\zbgCurZ.exe
        
        C:\Windows\System\zbgCurZ.exe
        5⤵
        
        PID:6172
    - - C:\Windows\System\HyolOWG.exe
        
        C:\Windows\System\HyolOWG.exe
        5⤵
        
        PID:7456
    - - C:\Windows\System\caJnuOR.exe
        
        C:\Windows\System\caJnuOR.exe
        5⤵
        
        PID:7236
    - - C:\Windows\System\twWxsMz.exe
        
        C:\Windows\System\twWxsMz.exe
        5⤵
        
        PID:8332
    - - C:\Windows\System\oLRwNbj.exe
        
        C:\Windows\System\oLRwNbj.exe
        5⤵
        
        PID:1644
    - - C:\Windows\System\adSDHxY.exe
        
        C:\Windows\System\adSDHxY.exe
        5⤵
        
        PID:7832
    - - C:\Windows\System\fgdKNpZ.exe
        
        C:\Windows\System\fgdKNpZ.exe
        5⤵
        
        PID:5384
    - - C:\Windows\System\avyEfVS.exe
        
        C:\Windows\System\avyEfVS.exe
        5⤵
        
        PID:6636
    - - C:\Windows\System\bhXrkag.exe
        
        C:\Windows\System\bhXrkag.exe
        5⤵
        
        PID:8124
    - - C:\Windows\System\NGfeTNW.exe
        
        C:\Windows\System\NGfeTNW.exe
        5⤵
        
        PID:8188
    - - C:\Windows\System\CsDJyEC.exe
        
        C:\Windows\System\CsDJyEC.exe
        5⤵
        
        PID:6116
    - - C:\Windows\System\dlWMCkc.exe
        
        C:\Windows\System\dlWMCkc.exe
        5⤵
        
        PID:6836
    - - C:\Windows\System\BpJswdt.exe
        
        C:\Windows\System\BpJswdt.exe
        5⤵
        
        PID:6536
    - - C:\Windows\System\wZumoEB.exe
        
        C:\Windows\System\wZumoEB.exe
        5⤵
        
        PID:4160
    - - C:\Windows\System\qgdlqPI.exe
        
        C:\Windows\System\qgdlqPI.exe
        5⤵
        
        PID:8428
    - - C:\Windows\System\wwLMhlz.exe
        
        C:\Windows\System\wwLMhlz.exe
        5⤵
        
        PID:8484
    - - C:\Windows\System\uTCazck.exe
        
        C:\Windows\System\uTCazck.exe
        5⤵
        
        PID:4708
    - - C:\Windows\System\MSZWjjf.exe
        
        C:\Windows\System\MSZWjjf.exe
        5⤵
        
        PID:6588
    - - C:\Windows\System\wlUfgwo.exe
        
        C:\Windows\System\wlUfgwo.exe
        5⤵
        
        PID:236
    - - C:\Windows\System\ILqrsjD.exe
        
        C:\Windows\System\ILqrsjD.exe
        5⤵
        
        PID:7196
    - - C:\Windows\System\bbgSBKH.exe
        
        C:\Windows\System\bbgSBKH.exe
        5⤵
        
        PID:7412
    - - C:\Windows\System\RDbjCTZ.exe
        
        C:\Windows\System\RDbjCTZ.exe
        5⤵
        
        PID:7524
    - - C:\Windows\System\FOlrmKZ.exe
        
        C:\Windows\System\FOlrmKZ.exe
        5⤵
        
        PID:7568
    - - C:\Windows\System\ulQzihY.exe
        
        C:\Windows\System\ulQzihY.exe
        5⤵
        
        PID:7632
    - - C:\Windows\System\hAibiJQ.exe
        
        C:\Windows\System\hAibiJQ.exe
        5⤵
        
        PID:7972
    - - C:\Windows\System\LcAsvNs.exe
        
        C:\Windows\System\LcAsvNs.exe
        5⤵
        
        PID:4048
    - - C:\Windows\System\EFgQxvx.exe
        
        C:\Windows\System\EFgQxvx.exe
        5⤵
        
        PID:8244
    - - C:\Windows\System\aGmYbsW.exe
        
        C:\Windows\System\aGmYbsW.exe
        5⤵
        
        PID:8896
    - - C:\Windows\System\tWmohti.exe
        
        C:\Windows\System\tWmohti.exe
        5⤵
        
        PID:8940
    - - C:\Windows\System\KkNheFn.exe
        
        C:\Windows\System\KkNheFn.exe
        5⤵
        
        PID:8376
    - - C:\Windows\System\PDzyzfG.exe
        
        C:\Windows\System\PDzyzfG.exe
        5⤵
        
        PID:8968
    - - C:\Windows\System\qUkyBPK.exe
        
        C:\Windows\System\qUkyBPK.exe
        5⤵
        
        PID:8508
    - - C:\Windows\System\yuUYSaJ.exe
        
        C:\Windows\System\yuUYSaJ.exe
        5⤵
        
        PID:8560
    - - C:\Windows\System\mzPKbsA.exe
        
        C:\Windows\System\mzPKbsA.exe
        5⤵
        
        PID:9164
    - - C:\Windows\System\nUvxnve.exe
        
        C:\Windows\System\nUvxnve.exe
        5⤵
        
        PID:9192
    - - C:\Windows\System\exowvcr.exe
        
        C:\Windows\System\exowvcr.exe
        5⤵
        
        PID:6984
    - - C:\Windows\System\GkVEnxx.exe
        
        C:\Windows\System\GkVEnxx.exe
        5⤵
        
        PID:8628
    - - C:\Windows\System\EVztLsy.exe
        
        C:\Windows\System\EVztLsy.exe
        5⤵
        
        PID:8672
    - - C:\Windows\System\VZUhxmR.exe
        
        C:\Windows\System\VZUhxmR.exe
        5⤵
        
        PID:8736
    - - C:\Windows\System\yROyBuZ.exe
        
        C:\Windows\System\yROyBuZ.exe
        5⤵
        
        PID:8796
    - - C:\Windows\System\ZukgFWv.exe
        
        C:\Windows\System\ZukgFWv.exe
        5⤵
        
        PID:6424
    - - C:\Windows\System\tEIXNsj.exe
        
        C:\Windows\System\tEIXNsj.exe
        5⤵
        
        PID:9252
    - - C:\Windows\System\HAuyrDM.exe
        
        C:\Windows\System\HAuyrDM.exe
        5⤵
        
        PID:9272
    - - C:\Windows\System\ahFVaKk.exe
        
        C:\Windows\System\ahFVaKk.exe
        5⤵
        
        PID:9304
    - - C:\Windows\System\tivWAcW.exe
        
        C:\Windows\System\tivWAcW.exe
        5⤵
        
        PID:9364
    - - C:\Windows\System\Ljozzfv.exe
        
        C:\Windows\System\Ljozzfv.exe
        5⤵
        
        PID:9400
    - - C:\Windows\System\GlfPirF.exe
        
        C:\Windows\System\GlfPirF.exe
        5⤵
        
        PID:9416
    - - C:\Windows\System\UWDbzrC.exe
        
        C:\Windows\System\UWDbzrC.exe
        5⤵
        
        PID:9472
    - - C:\Windows\System\oEosqPs.exe
        
        C:\Windows\System\oEosqPs.exe
        5⤵
        
        PID:9496
    - - C:\Windows\System\FELMXsq.exe
        
        C:\Windows\System\FELMXsq.exe
        5⤵
        
        PID:9512
    - - C:\Windows\System\pToJtGe.exe
        
        C:\Windows\System\pToJtGe.exe
        5⤵
        
        PID:9556
    - - C:\Windows\System\cecVwue.exe
        
        C:\Windows\System\cecVwue.exe
        5⤵
        
        PID:9576
    - - C:\Windows\System\rZEPEQu.exe
        
        C:\Windows\System\rZEPEQu.exe
        5⤵
        
        PID:9612
    - - C:\Windows\System\zdveEPT.exe
        
        C:\Windows\System\zdveEPT.exe
        5⤵
        
        PID:9628
    - - C:\Windows\System\QpFnrPq.exe
        
        C:\Windows\System\QpFnrPq.exe
        5⤵
        
        PID:9660
    - - C:\Windows\System\rxyYMWu.exe
        
        C:\Windows\System\rxyYMWu.exe
        5⤵
        
        PID:9720
    - - C:\Windows\System\NjfRYJm.exe
        
        C:\Windows\System\NjfRYJm.exe
        5⤵
        
        PID:9764
    - - C:\Windows\System\Uuvnmwx.exe
        
        C:\Windows\System\Uuvnmwx.exe
        5⤵
        
        PID:9784
    - - C:\Windows\System\sjbYwLl.exe
        
        C:\Windows\System\sjbYwLl.exe
        5⤵
        
        PID:9808
    - - C:\Windows\System\fqMpyNq.exe
        
        C:\Windows\System\fqMpyNq.exe
        5⤵
        
        PID:9856
    - - C:\Windows\System\gncCvrj.exe
        
        C:\Windows\System\gncCvrj.exe
        5⤵
        
        PID:9884
    - - C:\Windows\System\tuGhEry.exe
        
        C:\Windows\System\tuGhEry.exe
        5⤵
        
        PID:9916
    - - C:\Windows\System\xUqHsVE.exe
        
        C:\Windows\System\xUqHsVE.exe
        5⤵
        
        PID:9944
    - - C:\Windows\System\uyhaDHn.exe
        
        C:\Windows\System\uyhaDHn.exe
        5⤵
        
        PID:9964
    - - C:\Windows\System\UyyDMmO.exe
        
        C:\Windows\System\UyyDMmO.exe
        5⤵
        
        PID:9996
    - - C:\Windows\System\PaOGyAV.exe
        
        C:\Windows\System\PaOGyAV.exe
        5⤵
        
        PID:10036
    - - C:\Windows\System\ZHNBnKX.exe
        
        C:\Windows\System\ZHNBnKX.exe
        5⤵
        
        PID:10052
    - - C:\Windows\System\HPDFweL.exe
        
        C:\Windows\System\HPDFweL.exe
        5⤵
        
        PID:10072
    - - C:\Windows\System\VYdxZvF.exe
        
        C:\Windows\System\VYdxZvF.exe
        5⤵
        
        PID:10092
    - - C:\Windows\System\hbmNhsI.exe
        
        C:\Windows\System\hbmNhsI.exe
        5⤵
        
        PID:10120
    - - C:\Windows\System\RJYhjiH.exe
        
        C:\Windows\System\RJYhjiH.exe
        5⤵
        
        PID:10148
    - - C:\Windows\System\eqNULqd.exe
        
        C:\Windows\System\eqNULqd.exe
        5⤵
        
        PID:10164
    - - C:\Windows\System\IcrsRkE.exe
        
        C:\Windows\System\IcrsRkE.exe
        5⤵
        
        PID:10180
    - - C:\Windows\System\hRDPNnM.exe
        
        C:\Windows\System\hRDPNnM.exe
        5⤵
        
        PID:10204
    - - C:\Windows\System\xXrorrl.exe
        
        C:\Windows\System\xXrorrl.exe
        5⤵
        
        PID:10236
    - - C:\Windows\System\RYWkrks.exe
        
        C:\Windows\System\RYWkrks.exe
        5⤵
        
        PID:8960
    - - C:\Windows\System\stOetJl.exe
        
        C:\Windows\System\stOetJl.exe
        5⤵
        
        PID:8476
    - - C:\Windows\System\naCfMNL.exe
        
        C:\Windows\System\naCfMNL.exe
        5⤵
        
        PID:9036
    - - C:\Windows\System\sclpjqo.exe
        
        C:\Windows\System\sclpjqo.exe
        5⤵
        
        PID:9068
    - - C:\Windows\System\OiUOzAI.exe
        
        C:\Windows\System\OiUOzAI.exe
        5⤵
        
        PID:9120
    - - C:\Windows\System\TELCdCj.exe
        
        C:\Windows\System\TELCdCj.exe
        5⤵
        
        PID:8100
    - - C:\Windows\System\ThPHZom.exe
        
        C:\Windows\System\ThPHZom.exe
        5⤵
        
        PID:5940
    - - C:\Windows\System\nDjbJoU.exe
        
        C:\Windows\System\nDjbJoU.exe
        5⤵
        
        PID:8384
    - - C:\Windows\System\BLzMRJb.exe
        
        C:\Windows\System\BLzMRJb.exe
        5⤵
        
        PID:10248
    - - C:\Windows\System\LmlESjc.exe
        
        C:\Windows\System\LmlESjc.exe
        5⤵
        
        PID:10280
    - - C:\Windows\System\eDKYbxT.exe
        
        C:\Windows\System\eDKYbxT.exe
        5⤵
        
        PID:10316
    - - C:\Windows\System\BtjqAup.exe
        
        C:\Windows\System\BtjqAup.exe
        5⤵
        
        PID:10352
    - - C:\Windows\System\VmlnLBf.exe
        
        C:\Windows\System\VmlnLBf.exe
        5⤵
        
        PID:10388
    - - C:\Windows\System\gWeYAlP.exe
        
        C:\Windows\System\gWeYAlP.exe
        5⤵
        
        PID:10456
    - - C:\Windows\System\TJWzgLb.exe
        
        C:\Windows\System\TJWzgLb.exe
        5⤵
        
        PID:10480
    - - C:\Windows\System\nbLLAGh.exe
        
        C:\Windows\System\nbLLAGh.exe
        5⤵
        
        PID:10560
    - - C:\Windows\System\YIpUUDc.exe
        
        C:\Windows\System\YIpUUDc.exe
        5⤵
        
        PID:10592
    - - C:\Windows\System\gwxZgom.exe
        
        C:\Windows\System\gwxZgom.exe
        5⤵
        
        PID:10628
    - - C:\Windows\System\zAZlbNA.exe
        
        C:\Windows\System\zAZlbNA.exe
        5⤵
        
        PID:10676
    - - C:\Windows\System\yxqhYQj.exe
        
        C:\Windows\System\yxqhYQj.exe
        5⤵
        
        PID:10692
    - - C:\Windows\System\DLOjUgX.exe
        
        C:\Windows\System\DLOjUgX.exe
        5⤵
        
        PID:10724
    - - C:\Windows\System\eXWgAMX.exe
        
        C:\Windows\System\eXWgAMX.exe
        5⤵
        
        PID:10776
    - - C:\Windows\System\TWNgBVl.exe
        
        C:\Windows\System\TWNgBVl.exe
        5⤵
        
        PID:10792
    - - C:\Windows\System\RgkAteG.exe
        
        C:\Windows\System\RgkAteG.exe
        5⤵
        
        PID:10812
    - - C:\Windows\System\oSQcLZQ.exe
        
        C:\Windows\System\oSQcLZQ.exe
        5⤵
        
        PID:10832
    - - C:\Windows\System\mBZTyia.exe
        
        C:\Windows\System\mBZTyia.exe
        5⤵
        
        PID:10880
    - - C:\Windows\System\nNHLxKj.exe
        
        C:\Windows\System\nNHLxKj.exe
        5⤵
        
        PID:10936
    - - C:\Windows\System\ohFadTV.exe
        
        C:\Windows\System\ohFadTV.exe
        5⤵
        
        PID:11004
    - - C:\Windows\System\myGzTPW.exe
        
        C:\Windows\System\myGzTPW.exe
        5⤵
        
        PID:11048
    - - C:\Windows\System\nsJzdgW.exe
        
        C:\Windows\System\nsJzdgW.exe
        5⤵
        
        PID:11080
    - - C:\Windows\System\TbbrzLC.exe
        
        C:\Windows\System\TbbrzLC.exe
        5⤵
        
        PID:11104
    - - C:\Windows\System\kPpDjIL.exe
        
        C:\Windows\System\kPpDjIL.exe
        5⤵
        
        PID:11144
    - - C:\Windows\System\vfTHZGP.exe
        
        C:\Windows\System\vfTHZGP.exe
        5⤵
        
        PID:11180
    - - C:\Windows\System\ewmoisE.exe
        
        C:\Windows\System\ewmoisE.exe
        5⤵
        
        PID:11196
    - - C:\Windows\System\HHyyusk.exe
        
        C:\Windows\System\HHyyusk.exe
        5⤵
        
        PID:11212
    - - C:\Windows\System\suDCskW.exe
        
        C:\Windows\System\suDCskW.exe
        5⤵
        
        PID:11228
    - - C:\Windows\System\JlLkITP.exe
        
        C:\Windows\System\JlLkITP.exe
        5⤵
        
        PID:9332
    - - C:\Windows\System\dqBIMgc.exe
        
        C:\Windows\System\dqBIMgc.exe
        5⤵
        
        PID:9376
    - - C:\Windows\System\aBTRmPb.exe
        
        C:\Windows\System\aBTRmPb.exe
        5⤵
        
        PID:3396
    - - C:\Windows\System\pDpKYZQ.exe
        
        C:\Windows\System\pDpKYZQ.exe
        5⤵
        
        PID:2544
    - - C:\Windows\System\EaaGyXS.exe
        
        C:\Windows\System\EaaGyXS.exe
        5⤵
        
        PID:8004
    - - C:\Windows\System\CcYRkCy.exe
        
        C:\Windows\System\CcYRkCy.exe
        5⤵
        
        PID:6324
    - - C:\Windows\System\nbKOmfS.exe
        
        C:\Windows\System\nbKOmfS.exe
        5⤵
        
        PID:8456
    - - C:\Windows\System\SnpEQbi.exe
        
        C:\Windows\System\SnpEQbi.exe
        5⤵
        
        PID:8180
    - - C:\Windows\System\GkEoTev.exe
        
        C:\Windows\System\GkEoTev.exe
        5⤵
        
        PID:5232
    - - C:\Windows\System\eINkFyf.exe
        
        C:\Windows\System\eINkFyf.exe
        5⤵
        
        PID:6740
    - - C:\Windows\System\HsJIfnk.exe
        
        C:\Windows\System\HsJIfnk.exe
        5⤵
        
        PID:7432
    - - C:\Windows\System\dtYqjvW.exe
        
        C:\Windows\System\dtYqjvW.exe
        5⤵
        
        PID:6800
    - - C:\Windows\System\yjByRMA.exe
        
        C:\Windows\System\yjByRMA.exe
        5⤵
        
        PID:9184
    - - C:\Windows\System\gzEcDJZ.exe
        
        C:\Windows\System\gzEcDJZ.exe
        5⤵
        
        PID:8696
    - - C:\Windows\System\fFMjrny.exe
        
        C:\Windows\System\fFMjrny.exe
        5⤵
        
        PID:8788
    - - C:\Windows\System\vPkhOMP.exe
        
        C:\Windows\System\vPkhOMP.exe
        5⤵
        
        PID:11320
    - - C:\Windows\System\NVCNtZs.exe
        
        C:\Windows\System\NVCNtZs.exe
        5⤵
        
        PID:11360
    - - C:\Windows\System\cEgrvvx.exe
        
        C:\Windows\System\cEgrvvx.exe
        5⤵
        
        PID:11556
    - - C:\Windows\System\JwBBlck.exe
        
        C:\Windows\System\JwBBlck.exe
        5⤵
        
        PID:11572
    - - C:\Windows\System\ElfKUUd.exe
        
        C:\Windows\System\ElfKUUd.exe
        5⤵
        
        PID:11596
    - - C:\Windows\System\kRYUgpx.exe
        
        C:\Windows\System\kRYUgpx.exe
        5⤵
        
        PID:11616
    - - C:\Windows\System\QCAmjFK.exe
        
        C:\Windows\System\QCAmjFK.exe
        5⤵
        
        PID:11660
    - - C:\Windows\System\UcCGIlX.exe
        
        C:\Windows\System\UcCGIlX.exe
        5⤵
        
        PID:11680
    - - C:\Windows\System\SQeYCkL.exe
        
        C:\Windows\System\SQeYCkL.exe
        5⤵
        
        PID:11728
    - - C:\Windows\System\jBqGSvP.exe
        
        C:\Windows\System\jBqGSvP.exe
        5⤵
        
        PID:11752
    - - C:\Windows\System\cKmpQaS.exe
        
        C:\Windows\System\cKmpQaS.exe
        5⤵
        
        PID:11788
    - - C:\Windows\System\BwdSXbf.exe
        
        C:\Windows\System\BwdSXbf.exe
        5⤵
        
        PID:11812
    - - C:\Windows\System\pnVwbpY.exe
        
        C:\Windows\System\pnVwbpY.exe
        5⤵
        
        PID:11856
    - - C:\Windows\System\vJpDRhy.exe
        
        C:\Windows\System\vJpDRhy.exe
        5⤵
        
        PID:11908
    - - C:\Windows\System\lVCkZAh.exe
        
        C:\Windows\System\lVCkZAh.exe
        5⤵
        
        PID:11960
    - - C:\Windows\System\VKqHuCf.exe
        
        C:\Windows\System\VKqHuCf.exe
        5⤵
        
        PID:11980
    - - C:\Windows\System\dLxgiVX.exe
        
        C:\Windows\System\dLxgiVX.exe
        5⤵
        
        PID:12028
    - - C:\Windows\System\CZUZMmK.exe
        
        C:\Windows\System\CZUZMmK.exe
        5⤵
        
        PID:12072
    - - C:\Windows\System\EAQtnwQ.exe
        
        C:\Windows\System\EAQtnwQ.exe
        5⤵
        
        PID:12124
    - - C:\Windows\System\QkRdSLE.exe
        
        C:\Windows\System\QkRdSLE.exe
        5⤵
        
        PID:12200
    - - C:\Windows\System\zpFphvo.exe
        
        C:\Windows\System\zpFphvo.exe
        5⤵
        
        PID:12224
    - - C:\Windows\System\dRRkHwg.exe
        
        C:\Windows\System\dRRkHwg.exe
        5⤵
        
        PID:9728
    - - C:\Windows\System\IZEZJfV.exe
        
        C:\Windows\System\IZEZJfV.exe
        5⤵
        
        PID:7260
    - - C:\Windows\System\FWlAyAY.exe
        
        C:\Windows\System\FWlAyAY.exe
        5⤵
        
        PID:9876
    - - C:\Windows\System\vrKBjrY.exe
        
        C:\Windows\System\vrKBjrY.exe
        5⤵
        
        PID:10012
    - - C:\Windows\System\VTHDIcV.exe
        
        C:\Windows\System\VTHDIcV.exe
        5⤵
        
        PID:11024
    - - C:\Windows\System\CCZpXHf.exe
        
        C:\Windows\System\CCZpXHf.exe
        5⤵
        
        PID:7504
    - - C:\Windows\System\gELSBrz.exe
        
        C:\Windows\System\gELSBrz.exe
        5⤵
        
        PID:7660
    - - C:\Windows\System\TVLPPrK.exe
        
        C:\Windows\System\TVLPPrK.exe
        5⤵
        
        PID:12292
    - - C:\Windows\System\AUZPqnR.exe
        
        C:\Windows\System\AUZPqnR.exe
        5⤵
        
        PID:12316
    - - C:\Windows\System\MmeXdyi.exe
        
        C:\Windows\System\MmeXdyi.exe
        5⤵
        
        PID:12348
    - - C:\Windows\System\GuVyFBX.exe
        
        C:\Windows\System\GuVyFBX.exe
        5⤵
        
        PID:12400
    - - C:\Windows\System\kSdzGSj.exe
        
        C:\Windows\System\kSdzGSj.exe
        5⤵
        
        PID:12416
    - - C:\Windows\System\pTWIugk.exe
        
        C:\Windows\System\pTWIugk.exe
        5⤵
        
        PID:12440
    - - C:\Windows\System\aqMwYHA.exe
        
        C:\Windows\System\aqMwYHA.exe
        5⤵
        
        PID:12456
    - - C:\Windows\System\lWqkhxx.exe
        
        C:\Windows\System\lWqkhxx.exe
        5⤵
        
        PID:12472
    - - C:\Windows\System\JAPxDTK.exe
        
        C:\Windows\System\JAPxDTK.exe
        5⤵
        
        PID:12488
    - - C:\Windows\System\NSVLQCT.exe
        
        C:\Windows\System\NSVLQCT.exe
        5⤵
        
        PID:12504
    - - C:\Windows\System\cTfsodU.exe
        
        C:\Windows\System\cTfsodU.exe
        5⤵
        
        PID:12528
    - - C:\Windows\System\NwPkBQD.exe
        
        C:\Windows\System\NwPkBQD.exe
        5⤵
        
        PID:12544
    - - C:\Windows\System\XPpLLBY.exe
        
        C:\Windows\System\XPpLLBY.exe
        5⤵
        
        PID:12564
    - - C:\Windows\System\PntZMey.exe
        
        C:\Windows\System\PntZMey.exe
        5⤵
        
        PID:12584
    - - C:\Windows\System\NJmuumf.exe
        
        C:\Windows\System\NJmuumf.exe
        5⤵
        
        PID:12612
    - - C:\Windows\System\zmslRts.exe
        
        C:\Windows\System\zmslRts.exe
        5⤵
        
        PID:12632
    - - C:\Windows\System\ayCSbLf.exe
        
        C:\Windows\System\ayCSbLf.exe
        5⤵
        
        PID:12680
    - - C:\Windows\System\LnUABHh.exe
        
        C:\Windows\System\LnUABHh.exe
        5⤵
        
        PID:12700
    - - C:\Windows\System\jvTXIGK.exe
        
        C:\Windows\System\jvTXIGK.exe
        5⤵
        
        PID:12764
    - - C:\Windows\System\nWdMaSE.exe
        
        C:\Windows\System\nWdMaSE.exe
        5⤵
        
        PID:12792
    - - C:\Windows\System\NfKOrRe.exe
        
        C:\Windows\System\NfKOrRe.exe
        5⤵
        
        PID:12808
    - - C:\Windows\System\vkOmFvN.exe
        
        C:\Windows\System\vkOmFvN.exe
        5⤵
        
        PID:12824
    - - C:\Windows\System\pXCPvwW.exe
        
        C:\Windows\System\pXCPvwW.exe
        5⤵
        
        PID:12844
    - - C:\Windows\System\vHpsUOf.exe
        
        C:\Windows\System\vHpsUOf.exe
        5⤵
        
        PID:12860
    - - C:\Windows\System\lXEEtza.exe
        
        C:\Windows\System\lXEEtza.exe
        5⤵
        
        PID:12888
    - - C:\Windows\System\PaEWMtZ.exe
        
        C:\Windows\System\PaEWMtZ.exe
        5⤵
        
        PID:12904
    - - C:\Windows\System\RLqYszv.exe
        
        C:\Windows\System\RLqYszv.exe
        5⤵
        
        PID:12924
    - - C:\Windows\System\OThelEA.exe
        
        C:\Windows\System\OThelEA.exe
        5⤵
        
        PID:12952
    - - C:\Windows\System\uJSZCov.exe
        
        C:\Windows\System\uJSZCov.exe
        5⤵
        
        PID:12984
    - - C:\Windows\System\nkUFGUz.exe
        
        C:\Windows\System\nkUFGUz.exe
        5⤵
        
        PID:13008
    - - C:\Windows\System\xUeeWIP.exe
        
        C:\Windows\System\xUeeWIP.exe
        5⤵
        
        PID:13024
    - - C:\Windows\System\yPcinIk.exe
        
        C:\Windows\System\yPcinIk.exe
        5⤵
        
        PID:13040
    - - C:\Windows\System\UAgdKuS.exe
        
        C:\Windows\System\UAgdKuS.exe
        5⤵
        
        PID:13064
    - - C:\Windows\System\UOvrGAQ.exe
        
        C:\Windows\System\UOvrGAQ.exe
        5⤵
        
        PID:13080
    - - C:\Windows\System\dkbjaSY.exe
        
        C:\Windows\System\dkbjaSY.exe
        5⤵
        
        PID:13128
    - - C:\Windows\System\szfSngU.exe
        
        C:\Windows\System\szfSngU.exe
        5⤵
        
        PID:13156
    - - C:\Windows\System\phXXMcI.exe
        
        C:\Windows\System\phXXMcI.exe
        5⤵
        
        PID:13196
    - - C:\Windows\System\aNlJzKh.exe
        
        C:\Windows\System\aNlJzKh.exe
        5⤵
        
        PID:13212
    - - C:\Windows\System\zZqjkgz.exe
        
        C:\Windows\System\zZqjkgz.exe
        5⤵
        
        PID:13280
    - - C:\Windows\System\zdzFfHW.exe
        
        C:\Windows\System\zdzFfHW.exe
        5⤵
        
        PID:8092
    - - C:\Windows\System\gkfLHFH.exe
        
        C:\Windows\System\gkfLHFH.exe
        5⤵
        
        PID:9160
    - - C:\Windows\System\JKYMeVm.exe
        
        C:\Windows\System\JKYMeVm.exe
        5⤵
        
        PID:11284
    - - C:\Windows\System\sZNKVmk.exe
        
        C:\Windows\System\sZNKVmk.exe
        5⤵
        
        PID:11312
    - - C:\Windows\System\GIaQIBc.exe
        
        C:\Windows\System\GIaQIBc.exe
        5⤵
        
        PID:9244
    - - C:\Windows\System\aOdPuix.exe
        
        C:\Windows\System\aOdPuix.exe
        5⤵
        
        PID:9328
    - - C:\Windows\System\QZehwVi.exe
        
        C:\Windows\System\QZehwVi.exe
        5⤵
        
        PID:10380
    - - C:\Windows\System\PiphExS.exe
        
        C:\Windows\System\PiphExS.exe
        5⤵
        
        PID:9508
    - - C:\Windows\System\fHVjwuJ.exe
        
        C:\Windows\System\fHVjwuJ.exe
        5⤵
        
        PID:9568
    - - C:\Windows\System\OjWybdb.exe
        
        C:\Windows\System\OjWybdb.exe
        5⤵
        
        PID:9624
    - - C:\Windows\System\VVoSjOn.exe
        
        C:\Windows\System\VVoSjOn.exe
        5⤵
        
        PID:9692
    - - C:\Windows\System\zOEdUhG.exe
        
        C:\Windows\System\zOEdUhG.exe
        5⤵
        
        PID:9732
    - - C:\Windows\System\SYmwMAC.exe
        
        C:\Windows\System\SYmwMAC.exe
        5⤵
        
        PID:876
    - - C:\Windows\System\qdgTJxk.exe
        
        C:\Windows\System\qdgTJxk.exe
        5⤵
        
        PID:10088
    - - C:\Windows\System\HIReomY.exe
        
        C:\Windows\System\HIReomY.exe
        5⤵
        
        PID:13336
    - - C:\Windows\System\kCVUDUP.exe
        
        C:\Windows\System\kCVUDUP.exe
        5⤵
        
        PID:14220
    - - C:\Windows\System\qUwdeEf.exe
        
        C:\Windows\System\qUwdeEf.exe
        5⤵
        
        PID:14296
    - - C:\Windows\System\kQdEsIg.exe
        
        C:\Windows\System\kQdEsIg.exe
        5⤵
        
        PID:14328
    - - C:\Windows\System\YpHYSME.exe
        
        C:\Windows\System\YpHYSME.exe
        5⤵
        
        PID:12088
    - - C:\Windows\System\aYqPUOm.exe
        
        C:\Windows\System\aYqPUOm.exe
        5⤵
        
        PID:2932
    - - C:\Windows\System\UHRwJTS.exe
        
        C:\Windows\System\UHRwJTS.exe
        5⤵
        
        PID:10112
    - - C:\Windows\System\hgkQUkk.exe
        
        C:\Windows\System\hgkQUkk.exe
        5⤵
        
        PID:11236
    - - C:\Windows\System\COUaMSs.exe
        
        C:\Windows\System\COUaMSs.exe
        5⤵
        
        PID:11256
    - - C:\Windows\System\vZMRTxS.exe
        
        C:\Windows\System\vZMRTxS.exe
        5⤵
        
        PID:10176
    - - C:\Windows\System\mCmTwli.exe
        
        C:\Windows\System\mCmTwli.exe
        5⤵
        
        PID:5204
    - - C:\Windows\System\EYaCyPS.exe
        
        C:\Windows\System\EYaCyPS.exe
        5⤵
        
        PID:12468
    - - C:\Windows\System\UuMSVvM.exe
        
        C:\Windows\System\UuMSVvM.exe
        5⤵
        
        PID:12592
    - - C:\Windows\System\Vpyzaqy.exe
        
        C:\Windows\System\Vpyzaqy.exe
        5⤵
        
        PID:12800
    - - C:\Windows\System\pTuiDeI.exe
        
        C:\Windows\System\pTuiDeI.exe
        5⤵
        
        PID:13092
    - - C:\Windows\System\FNYNQMS.exe
        
        C:\Windows\System\FNYNQMS.exe
        5⤵
        
        PID:8572
    - - C:\Windows\System\sYYYnip.exe
        
        C:\Windows\System\sYYYnip.exe
        5⤵
        
        PID:6484
    - - C:\Windows\System\JBighOi.exe
        
        C:\Windows\System\JBighOi.exe
        5⤵
        
        PID:8720
    - - C:\Windows\System\QCIRJHO.exe
        
        C:\Windows\System\QCIRJHO.exe
        5⤵
        
        PID:13192
    - - C:\Windows\System\RlMYcPS.exe
        
        C:\Windows\System\RlMYcPS.exe
        5⤵
        
        PID:10288
    - - C:\Windows\System\cICyjwp.exe
        
        C:\Windows\System\cICyjwp.exe
        5⤵
        
        PID:10336
    - - C:\Windows\System\aCLiGHS.exe
        
        C:\Windows\System\aCLiGHS.exe
        5⤵
        
        PID:10644
    - - C:\Windows\System\TVHZKQR.exe
        
        C:\Windows\System\TVHZKQR.exe
        5⤵
        
        PID:10716
    - - C:\Windows\System\lxagivK.exe
        
        C:\Windows\System\lxagivK.exe
        5⤵
        
        PID:10744
    - - C:\Windows\System\uqZFrIT.exe
        
        C:\Windows\System\uqZFrIT.exe
        5⤵
        
        PID:10788
    - - C:\Windows\System\qFckZKa.exe
        
        C:\Windows\System\qFckZKa.exe
        5⤵
        
        PID:10868
    - - C:\Windows\System\jvrZtxH.exe
        
        C:\Windows\System\jvrZtxH.exe
        5⤵
        
        PID:10960
    - - C:\Windows\System\OLRrOBC.exe
        
        C:\Windows\System\OLRrOBC.exe
        5⤵
        
        PID:11036
    - - C:\Windows\System\irqdnws.exe
        
        C:\Windows\System\irqdnws.exe
        5⤵
        
        PID:1324
    - - C:\Windows\System\xqKBUPw.exe
        
        C:\Windows\System\xqKBUPw.exe
        5⤵
        
        PID:7280
    - - C:\Windows\System\ZsnGXEl.exe
        
        C:\Windows\System\ZsnGXEl.exe
        5⤵
        
        PID:11656
    - - C:\Windows\System\cRmEjcw.exe
        
        C:\Windows\System\cRmEjcw.exe
        5⤵
        
        PID:11692
    - - C:\Windows\System\qnKaVEU.exe
        
        C:\Windows\System\qnKaVEU.exe
        5⤵
        
        PID:9392
    - - C:\Windows\System\FHLxnOe.exe
        
        C:\Windows\System\FHLxnOe.exe
        5⤵
        
        PID:9424
    - - C:\Windows\System\dxJteuw.exe
        
        C:\Windows\System\dxJteuw.exe
        5⤵
        
        PID:12064
    - - C:\Windows\System\XwdQGUw.exe
        
        C:\Windows\System\XwdQGUw.exe
        5⤵
        
        PID:12192
    - - C:\Windows\System\qsuCcXm.exe
        
        C:\Windows\System\qsuCcXm.exe
        5⤵
        
        PID:9736
    - - C:\Windows\System\aHvZKzQ.exe
        
        C:\Windows\System\aHvZKzQ.exe
        5⤵
        
        PID:5208
    - - C:\Windows\System\cmEOdxP.exe
        
        C:\Windows\System\cmEOdxP.exe
        5⤵
        
        PID:9980
    - - C:\Windows\System\icKWJKr.exe
        
        C:\Windows\System\icKWJKr.exe
        5⤵
        
        PID:13600
    - - C:\Windows\System\goedjBM.exe
        
        C:\Windows\System\goedjBM.exe
        5⤵
        
        PID:12520
    - - C:\Windows\System\wWskZKg.exe
        
        C:\Windows\System\wWskZKg.exe
        5⤵
        
        PID:12540
    - - C:\Windows\System\LOyOqYz.exe
        
        C:\Windows\System\LOyOqYz.exe
        5⤵
        
        PID:12552
    - - C:\Windows\System\zPmaLvy.exe
        
        C:\Windows\System\zPmaLvy.exe
        5⤵
        
        PID:7672
    - - C:\Windows\System\FklUkQq.exe
        
        C:\Windows\System\FklUkQq.exe
        5⤵
        
        PID:12832
    - - C:\Windows\System\ShLHBRO.exe
        
        C:\Windows\System\ShLHBRO.exe
        5⤵
        
        PID:14356
    - - C:\Windows\System\pDlslRU.exe
        
        C:\Windows\System\pDlslRU.exe
        5⤵
        
        PID:14392
    - - C:\Windows\System\lWuRnFP.exe
        
        C:\Windows\System\lWuRnFP.exe
        5⤵
        
        PID:14428
    - - C:\Windows\System\nmGofiW.exe
        
        C:\Windows\System\nmGofiW.exe
        5⤵
        
        PID:14460
    - - C:\Windows\System\ettPpFm.exe
        
        C:\Windows\System\ettPpFm.exe
        5⤵
        
        PID:14496
    - - C:\Windows\System\vETzwtd.exe
        
        C:\Windows\System\vETzwtd.exe
        5⤵
        
        PID:14532
    - - C:\Windows\System\NvqDVEF.exe
        
        C:\Windows\System\NvqDVEF.exe
        5⤵
        
        PID:14568
    - - C:\Windows\System\IiNKZVs.exe
        
        C:\Windows\System\IiNKZVs.exe
        5⤵
        
        PID:14604
    - - C:\Windows\System\JIgveye.exe
        
        C:\Windows\System\JIgveye.exe
        5⤵
        
        PID:14640
    - - C:\Windows\System\jquECXL.exe
        
        C:\Windows\System\jquECXL.exe
        5⤵
        
        PID:14672
    - - C:\Windows\System\mLwtbVa.exe
        
        C:\Windows\System\mLwtbVa.exe
        5⤵
        
        PID:14704
    - - C:\Windows\System\HqzNxjR.exe
        
        C:\Windows\System\HqzNxjR.exe
        5⤵
        
        PID:14740
    - - C:\Windows\System\OZlZFMY.exe
        
        C:\Windows\System\OZlZFMY.exe
        5⤵
        
        PID:14772
    - - C:\Windows\System\KwjiwTY.exe
        
        C:\Windows\System\KwjiwTY.exe
        5⤵
        
        PID:14804
    - - C:\Windows\System\XXwJZgb.exe
        
        C:\Windows\System\XXwJZgb.exe
        5⤵
        
        PID:14820
    - - C:\Windows\System\aIkMXjp.exe
        
        C:\Windows\System\aIkMXjp.exe
        5⤵
        
        PID:14836
    - - C:\Windows\System\qrsTqyO.exe
        
        C:\Windows\System\qrsTqyO.exe
        5⤵
        
        PID:14860
    - - C:\Windows\System\KBnIIWq.exe
        
        C:\Windows\System\KBnIIWq.exe
        5⤵
        
        PID:14876
    - - C:\Windows\System\dVMiqWe.exe
        
        C:\Windows\System\dVMiqWe.exe
        5⤵
        
        PID:14892
    - - C:\Windows\System\tkFVglT.exe
        
        C:\Windows\System\tkFVglT.exe
        5⤵
        
        PID:14912
    - - C:\Windows\System\vvKvEjU.exe
        
        C:\Windows\System\vvKvEjU.exe
        5⤵
        
        PID:14964
    - - C:\Windows\System\txhCJQC.exe
        
        C:\Windows\System\txhCJQC.exe
        5⤵
        
        PID:14980
    - - C:\Windows\System\GYfNSkN.exe
        
        C:\Windows\System\GYfNSkN.exe
        5⤵
        
        PID:14996
    - - C:\Windows\System\yYQIGlL.exe
        
        C:\Windows\System\yYQIGlL.exe
        5⤵
        
        PID:15012
    - - C:\Windows\System\CwpWCLD.exe
        
        C:\Windows\System\CwpWCLD.exe
        5⤵
        
        PID:15080
    - - C:\Windows\System\inQIeqv.exe
        
        C:\Windows\System\inQIeqv.exe
        5⤵
        
        PID:15104
    - - C:\Windows\System\bfbSRGb.exe
        
        C:\Windows\System\bfbSRGb.exe
        5⤵
        
        PID:15148
    - - C:\Windows\System\pMMSzCr.exe
        
        C:\Windows\System\pMMSzCr.exe
        5⤵
        
        PID:15172
    - - C:\Windows\System\oroxBzG.exe
        
        C:\Windows\System\oroxBzG.exe
        5⤵
        
        PID:15204
    - - C:\Windows\System\leyCXTS.exe
        
        C:\Windows\System\leyCXTS.exe
        5⤵
        
        PID:15228
    - - C:\Windows\System\GkDxreX.exe
        
        C:\Windows\System\GkDxreX.exe
        5⤵
        
        PID:15272
    - - C:\Windows\System\TDgcFcp.exe
        
        C:\Windows\System\TDgcFcp.exe
        5⤵
        
        PID:15308
    - - C:\Windows\System\glUQiET.exe
        
        C:\Windows\System\glUQiET.exe
        5⤵
        
        PID:6452
    - - C:\Windows\System\HTGGLAv.exe
        
        C:\Windows\System\HTGGLAv.exe
        5⤵
        
        PID:9924
    - - C:\Windows\System\dzrnonq.exe
        
        C:\Windows\System\dzrnonq.exe
        5⤵
        
        PID:7356
    - - C:\Windows\System\sJIJfqy.exe
        
        C:\Windows\System\sJIJfqy.exe
        5⤵
        
        PID:12332
    - - C:\Windows\System\bhRkoeL.exe
        
        C:\Windows\System\bhRkoeL.exe
        5⤵
        
        PID:10328
    - - C:\Windows\System\MDdkYYj.exe
        
        C:\Windows\System\MDdkYYj.exe
        5⤵
        
        PID:12160
    - - C:\Windows\System\fncsMav.exe
        
        C:\Windows\System\fncsMav.exe
        5⤵
        
        PID:8532
    - - C:\Windows\System\TZHRqXE.exe
        
        C:\Windows\System\TZHRqXE.exe
        5⤵
        
        PID:5440
    - - C:\Windows\System\OChmOMA.exe
        
        C:\Windows\System\OChmOMA.exe
        5⤵
        
        PID:10532
    - - C:\Windows\System\PZDCAHh.exe
        
        C:\Windows\System\PZDCAHh.exe
        5⤵
        
        PID:10588
    - - C:\Windows\System\aNuEOiZ.exe
        
        C:\Windows\System\aNuEOiZ.exe
        5⤵
        
        PID:12436
    - - C:\Windows\System\RxMCiNI.exe
        
        C:\Windows\System\RxMCiNI.exe
        5⤵
        
        PID:9372
    - - C:\Windows\System\uHZZkNH.exe
        
        C:\Windows\System\uHZZkNH.exe
        5⤵
        
        PID:12652
    - - C:\Windows\System\trRyoIS.exe
        
        C:\Windows\System\trRyoIS.exe
        5⤵
        
        PID:12724
    - - C:\Windows\System\WsPBcBu.exe
        
        C:\Windows\System\WsPBcBu.exe
        5⤵
        
        PID:12740
    - - C:\Windows\System\xxQJVyC.exe
        
        C:\Windows\System\xxQJVyC.exe
        5⤵
        
        PID:13704
    - - C:\Windows\System\xmfwUOX.exe
        
        C:\Windows\System\xmfwUOX.exe
        5⤵
        
        PID:12876
    - - C:\Windows\System\PYKwhyR.exe
        
        C:\Windows\System\PYKwhyR.exe
        5⤵
        
        PID:12900
    - - C:\Windows\System\kPKzoHD.exe
        
        C:\Windows\System\kPKzoHD.exe
        5⤵
        
        PID:13724
    - - C:\Windows\System\ijBHoRG.exe
        
        C:\Windows\System\ijBHoRG.exe
        5⤵
        
        PID:14668
    - - C:\Windows\System\oiBkpkA.exe
        
        C:\Windows\System\oiBkpkA.exe
        5⤵
        
        PID:14800
    - - C:\Windows\System\lsMraSZ.exe
        
        C:\Windows\System\lsMraSZ.exe
        5⤵
        
        PID:13732
    - - C:\Windows\System\iKfCxoq.exe
        
        C:\Windows\System\iKfCxoq.exe
        5⤵
        
        PID:4952
    - - C:\Windows\System\vQoSJGx.exe
        
        C:\Windows\System\vQoSJGx.exe
        5⤵
        
        PID:11220
    - - C:\Windows\System\osqfnOh.exe
        
        C:\Windows\System\osqfnOh.exe
        5⤵
        
        PID:7296
    - - C:\Windows\System\NPnyWLV.exe
        
        C:\Windows\System\NPnyWLV.exe
        5⤵
        
        PID:8392
    - - C:\Windows\System\UrLiBkp.exe
        
        C:\Windows\System\UrLiBkp.exe
        5⤵
        
        PID:13168
    - - C:\Windows\System\LaKSEQN.exe
        
        C:\Windows\System\LaKSEQN.exe
        5⤵
        
        PID:13844
    - - C:\Windows\System\KbJOtZM.exe
        
        C:\Windows\System\KbJOtZM.exe
        5⤵
        
        PID:5456
    - - C:\Windows\System\VuaogGT.exe
        
        C:\Windows\System\VuaogGT.exe
        5⤵
        
        PID:9132
    - - C:\Windows\System\QUSoMTD.exe
        
        C:\Windows\System\QUSoMTD.exe
        5⤵
        
        PID:11308
    - - C:\Windows\System\lxSQmda.exe
        
        C:\Windows\System\lxSQmda.exe
        5⤵
        
        PID:9532
    - - C:\Windows\System\BzWWGbY.exe
        
        C:\Windows\System\BzWWGbY.exe
        5⤵
        
        PID:15364
    - - C:\Windows\System\kicdjPu.exe
        
        C:\Windows\System\kicdjPu.exe
        5⤵
        
        PID:15380
    - - C:\Windows\System\JlxucCl.exe
        
        C:\Windows\System\JlxucCl.exe
        5⤵
        
        PID:15412
    - - C:\Windows\System\OQtgPIs.exe
        
        C:\Windows\System\OQtgPIs.exe
        5⤵
        
        PID:15448
    - - C:\Windows\System\TfbmIQM.exe
        
        C:\Windows\System\TfbmIQM.exe
        5⤵
        
        PID:15484
    - - C:\Windows\System\fjVLVpQ.exe
        
        C:\Windows\System\fjVLVpQ.exe
        5⤵
        
        PID:15524
    - - C:\Windows\System\TbacLez.exe
        
        C:\Windows\System\TbacLez.exe
        5⤵
        
        PID:15552
    - - C:\Windows\System\qISRSON.exe
        
        C:\Windows\System\qISRSON.exe
        5⤵
        
        PID:15580
    - - C:\Windows\System\kUdqmQx.exe
        
        C:\Windows\System\kUdqmQx.exe
        5⤵
        
        PID:15620
    - - C:\Windows\System\TvvhYJQ.exe
        
        C:\Windows\System\TvvhYJQ.exe
        5⤵
        
        PID:15644
    - - C:\Windows\System\wKubFsA.exe
        
        C:\Windows\System\wKubFsA.exe
        5⤵
        
        PID:15700
    - - C:\Windows\System\TbrQCTM.exe
        
        C:\Windows\System\TbrQCTM.exe
        5⤵
        
        PID:15748
    - - C:\Windows\System\fbxwbRI.exe
        
        C:\Windows\System\fbxwbRI.exe
        5⤵
        
        PID:7324
    - - C:\Windows\System\fJQmTAD.exe
        
        C:\Windows\System\fJQmTAD.exe
        5⤵
        
        PID:12376
    - - C:\Windows\System\rlZOrmn.exe
        
        C:\Windows\System\rlZOrmn.exe
        5⤵
        
        PID:9552
    - - C:\Windows\System\OdgbsOy.exe
        
        C:\Windows\System\OdgbsOy.exe
        5⤵
        
        PID:14796
    - - C:\Windows\System\WVTDDIW.exe
        
        C:\Windows\System\WVTDDIW.exe
        5⤵
        
        PID:12556
    - - C:\Windows\System\RRsTxtF.exe
        
        C:\Windows\System\RRsTxtF.exe
        5⤵
        
        PID:14952
    - - C:\Windows\System\YcwQDTX.exe
        
        C:\Windows\System\YcwQDTX.exe
        5⤵
        
        PID:13792
    - - C:\Windows\System\sJiNyfN.exe
        
        C:\Windows\System\sJiNyfN.exe
        5⤵
        
        PID:12336
    - - C:\Windows\System\yzYdGwr.exe
        
        C:\Windows\System\yzYdGwr.exe
        5⤵
        
        PID:15064
    - - C:\Windows\System\Rexdnzh.exe
        
        C:\Windows\System\Rexdnzh.exe
        5⤵
        
        PID:13816
    - - C:\Windows\System\GYfjnLh.exe
        
        C:\Windows\System\GYfjnLh.exe
        5⤵
        
        PID:13308
    - - C:\Windows\System\XCDPwGb.exe
        
        C:\Windows\System\XCDPwGb.exe
        5⤵
        
        PID:15196
    - - C:\Windows\System\utzfiLo.exe
        
        C:\Windows\System\utzfiLo.exe
        5⤵
        
        PID:13004
    - - C:\Windows\System\rGTPXvp.exe
        
        C:\Windows\System\rGTPXvp.exe
        5⤵
        
        PID:13904
    - - C:\Windows\System\zxScERo.exe
        
        C:\Windows\System\zxScERo.exe
        5⤵
        
        PID:13920
    - - C:\Windows\System\IMpMJVq.exe
        
        C:\Windows\System\IMpMJVq.exe
        5⤵
        
        PID:13944
    - - C:\Windows\System\HXgcvfB.exe
        
        C:\Windows\System\HXgcvfB.exe
        5⤵
        
        PID:13972
    - - C:\Windows\System\qKNnJne.exe
        
        C:\Windows\System\qKNnJne.exe
        5⤵
        
        PID:14036
    - - C:\Windows\System\NFqTjfj.exe
        
        C:\Windows\System\NFqTjfj.exe
        5⤵
        
        PID:13984
    - - C:\Windows\System\cDgGDNB.exe
        
        C:\Windows\System\cDgGDNB.exe
        5⤵
        
        PID:14760
    - - C:\Windows\System\LhPrtqb.exe
        
        C:\Windows\System\LhPrtqb.exe
        5⤵
        
        PID:11156
    - - C:\Windows\System\EdfaFWM.exe
        
        C:\Windows\System\EdfaFWM.exe
        5⤵
        
        PID:10032
    - - C:\Windows\System\RDaMpGo.exe
        
        C:\Windows\System\RDaMpGo.exe
        5⤵
        
        PID:10568
    - - C:\Windows\System\ZviMbGP.exe
        
        C:\Windows\System\ZviMbGP.exe
        5⤵
        
        PID:11736
    - - C:\Windows\System\cRPHXXS.exe
        
        C:\Windows\System\cRPHXXS.exe
        5⤵
        
        PID:12856
    - - C:\Windows\System\xVccCXo.exe
        
        C:\Windows\System\xVccCXo.exe
        5⤵
        
        PID:932
    - - C:\Windows\System\qNRazkH.exe
        
        C:\Windows\System\qNRazkH.exe
        5⤵
        
        PID:5256
    - - C:\Windows\System\pYUvDuu.exe
        
        C:\Windows\System\pYUvDuu.exe
        5⤵
        
        PID:8488
    - - C:\Windows\System\bWZzCwj.exe
        
        C:\Windows\System\bWZzCwj.exe
        5⤵
        
        PID:8844
    - - C:\Windows\System\HzkKHYj.exe
        
        C:\Windows\System\HzkKHYj.exe
        5⤵
        
        PID:9640
    - - C:\Windows\System\mTvYOCG.exe
        
        C:\Windows\System\mTvYOCG.exe
        5⤵
        
        PID:15392
    - - C:\Windows\System\espBotN.exe
        
        C:\Windows\System\espBotN.exe
        5⤵
        
        PID:15512
    - - C:\Windows\System\ZQfPhGX.exe
        
        C:\Windows\System\ZQfPhGX.exe
        5⤵
        
        PID:11504
    - - C:\Windows\System\QdoNXSM.exe
        
        C:\Windows\System\QdoNXSM.exe
        5⤵
        
        PID:9348
    - - C:\Windows\System\AeKgJct.exe
        
        C:\Windows\System\AeKgJct.exe
        5⤵
        
        PID:15864
    - - C:\Windows\System\rlJJZta.exe
        
        C:\Windows\System\rlJJZta.exe
        5⤵
        
        PID:14988
    - - C:\Windows\System\WyjIXol.exe
        
        C:\Windows\System\WyjIXol.exe
        5⤵
        
        PID:16020
    - - C:\Windows\System\UPkpoea.exe
        
        C:\Windows\System\UPkpoea.exe
        5⤵
        
        PID:11204
    - - C:\Windows\System\ajLpreJ.exe
        
        C:\Windows\System\ajLpreJ.exe
        5⤵
        
        PID:7328
    - - C:\Windows\System\kQeGqEg.exe
        
        C:\Windows\System\kQeGqEg.exe
        5⤵
        
        PID:16420
    - - C:\Windows\System\VnSifzp.exe
        
        C:\Windows\System\VnSifzp.exe
        5⤵
        
        PID:16456
    - - C:\Windows\System\ZwUrqQu.exe
        
        C:\Windows\System\ZwUrqQu.exe
        5⤵
        
        PID:16492
    - - C:\Windows\System\GhNVkmt.exe
        
        C:\Windows\System\GhNVkmt.exe
        5⤵
        
        PID:16532
    - - C:\Windows\System\wPChXpD.exe
        
        C:\Windows\System\wPChXpD.exe
        5⤵
        
        PID:16560
    - - C:\Windows\System\fVOToPL.exe
        
        C:\Windows\System\fVOToPL.exe
        5⤵
        
        PID:16592
    - - C:\Windows\System\KTrNRpF.exe
        
        C:\Windows\System\KTrNRpF.exe
        5⤵
        
        PID:16632
    - - C:\Windows\System\mkgSSHp.exe
        
        C:\Windows\System\mkgSSHp.exe
        5⤵
        
        PID:16652
    - - C:\Windows\System\fnoAUbi.exe
        
        C:\Windows\System\fnoAUbi.exe
        5⤵
        
        PID:16676
    - - C:\Windows\System\PTzveMG.exe
        
        C:\Windows\System\PTzveMG.exe
        5⤵
        
        PID:16700
    - - C:\Windows\System\onUbeIb.exe
        
        C:\Windows\System\onUbeIb.exe
        5⤵
        
        PID:16748
    - - C:\Windows\System\yIItwCI.exe
        
        C:\Windows\System\yIItwCI.exe
        5⤵
        
        PID:16768
    - - C:\Windows\System\ssUMafA.exe
        
        C:\Windows\System\ssUMafA.exe
        5⤵
        
        PID:16788
    - - C:\Windows\System\ZOLqzsf.exe
        
        C:\Windows\System\ZOLqzsf.exe
        5⤵
        
        PID:16904
    - - C:\Windows\System\jALfXFq.exe
        
        C:\Windows\System\jALfXFq.exe
        5⤵
        
        PID:16936
    - - C:\Windows\System\oKMnJPw.exe
        
        C:\Windows\System\oKMnJPw.exe
        5⤵
        
        PID:16972
    - - C:\Windows\System\uyyxqtt.exe
        
        C:\Windows\System\uyyxqtt.exe
        5⤵
        
        PID:16992
    - - C:\Windows\System\wrpJcDs.exe
        
        C:\Windows\System\wrpJcDs.exe
        5⤵
        
        PID:17032
    - - C:\Windows\System\ZjNEEcE.exe
        
        C:\Windows\System\ZjNEEcE.exe
        5⤵
        
        PID:17056
    - - C:\Windows\System\WUlebDK.exe
        
        C:\Windows\System\WUlebDK.exe
        5⤵
        
        PID:17084
    - - C:\Windows\System\gVnHrQw.exe
        
        C:\Windows\System\gVnHrQw.exe
        5⤵
        
        PID:17100
    - - C:\Windows\System\DQVyukP.exe
        
        C:\Windows\System\DQVyukP.exe
        5⤵
        
        PID:17116
    - - C:\Windows\System\invpIUb.exe
        
        C:\Windows\System\invpIUb.exe
        5⤵
        
        PID:17136
    - - C:\Windows\System\ioxBdkU.exe
        
        C:\Windows\System\ioxBdkU.exe
        5⤵
        
        PID:17168
    - - C:\Windows\System\RJNcJOX.exe
        
        C:\Windows\System\RJNcJOX.exe
        5⤵
        
        PID:17204
    - - C:\Windows\System\YvAAitr.exe
        
        C:\Windows\System\YvAAitr.exe
        5⤵
        
        PID:17228
    - - C:\Windows\System\MyyIFXu.exe
        
        C:\Windows\System\MyyIFXu.exe
        5⤵
        
        PID:17280
    - - C:\Windows\System\vLvAsKy.exe
        
        C:\Windows\System\vLvAsKy.exe
        5⤵
        
        PID:17300
    - - C:\Windows\System\ydUIfAd.exe
        
        C:\Windows\System\ydUIfAd.exe
        5⤵
        
        PID:17364
    - - C:\Windows\System\sQDYLKH.exe
        
        C:\Windows\System\sQDYLKH.exe
        5⤵
        
        PID:17404
    - - C:\Windows\System\IDsSLId.exe
        
        C:\Windows\System\IDsSLId.exe
        5⤵
        
        PID:11372
    - - C:\Windows\System\xRpaihy.exe
        
        C:\Windows\System\xRpaihy.exe
        5⤵
        
        PID:16312
    - - C:\Windows\System\EiuvkbL.exe
        
        C:\Windows\System\EiuvkbL.exe
        5⤵
        
        PID:16372
    - - C:\Windows\System\TdlPZRx.exe
        
        C:\Windows\System\TdlPZRx.exe
        5⤵
        
        PID:9956
    - - C:\Windows\System\ykyeEtM.exe
        
        C:\Windows\System\ykyeEtM.exe
        5⤵
        
        PID:13520
    - - C:\Windows\System\StdDMku.exe
        
        C:\Windows\System\StdDMku.exe
        5⤵
        
        PID:9096
    - - C:\Windows\System\PrVWujJ.exe
        
        C:\Windows\System\PrVWujJ.exe
        5⤵
        
        PID:14928
    - - C:\Windows\System\cPHKvVF.exe
        
        C:\Windows\System\cPHKvVF.exe
        5⤵
        
        PID:14596
    - - C:\Windows\System\DHniWvi.exe
        
        C:\Windows\System\DHniWvi.exe
        5⤵
        
        PID:17412
    - - C:\Windows\System\GdhGYwT.exe
        
        C:\Windows\System\GdhGYwT.exe
        5⤵
        
        PID:17468
    - - C:\Windows\System\wAsfvOV.exe
        
        C:\Windows\System\wAsfvOV.exe
        5⤵
        
        PID:17520
    - - C:\Windows\System\WCcHqKC.exe
        
        C:\Windows\System\WCcHqKC.exe
        5⤵
        
        PID:17572
    - - C:\Windows\System\vnLZGRm.exe
        
        C:\Windows\System\vnLZGRm.exe
        5⤵
        
        PID:17604
    - - C:\Windows\System\aKTaHXg.exe
        
        C:\Windows\System\aKTaHXg.exe
        5⤵
        
        PID:17640
    - - C:\Windows\System\duYUlzW.exe
        
        C:\Windows\System\duYUlzW.exe
        5⤵
        
        PID:17672
    - - C:\Windows\System\TalELak.exe
        
        C:\Windows\System\TalELak.exe
        5⤵
        
        PID:17692
    - - C:\Windows\System\kuYNLgr.exe
        
        C:\Windows\System\kuYNLgr.exe
        5⤵
        
        PID:17708
    - - C:\Windows\System\badIrqZ.exe
        
        C:\Windows\System\badIrqZ.exe
        5⤵
        
        PID:17728
    - - C:\Windows\System\LFGApMR.exe
        
        C:\Windows\System\LFGApMR.exe
        5⤵
        
        PID:17744
    - - C:\Windows\System\kXKBXsb.exe
        
        C:\Windows\System\kXKBXsb.exe
        5⤵
        
        PID:17784
    - - C:\Windows\System\IjVnbqK.exe
        
        C:\Windows\System\IjVnbqK.exe
        5⤵
        
        PID:17828
    - - C:\Windows\System\ioFdRTI.exe
        
        C:\Windows\System\ioFdRTI.exe
        5⤵
        
        PID:17868
    - - C:\Windows\System\KWdthKe.exe
        
        C:\Windows\System\KWdthKe.exe
        5⤵
        
        PID:17912
    - - C:\Windows\System\lqorNyp.exe
        
        C:\Windows\System\lqorNyp.exe
        5⤵
        
        PID:17988
    - - C:\Windows\System\ucAFfxk.exe
        
        C:\Windows\System\ucAFfxk.exe
        5⤵
        
        PID:18028
    - - C:\Windows\System\VkUrISq.exe
        
        C:\Windows\System\VkUrISq.exe
        5⤵
        
        PID:18060
    - - C:\Windows\System\YYUuhrm.exe
        
        C:\Windows\System\YYUuhrm.exe
        5⤵
        
        PID:18104
    - - C:\Windows\System\ILpDbbM.exe
        
        C:\Windows\System\ILpDbbM.exe
        5⤵
        
        PID:18132
    - - C:\Windows\System\znymZCD.exe
        
        C:\Windows\System\znymZCD.exe
        5⤵
        
        PID:18184
    - - C:\Windows\System\jMQuWJx.exe
        
        C:\Windows\System\jMQuWJx.exe
        5⤵
        
        PID:18228
    - - C:\Windows\System\bwHdykr.exe
        
        C:\Windows\System\bwHdykr.exe
        5⤵
        
        PID:18276
    - - C:\Windows\System\oDgyVZo.exe
        
        C:\Windows\System\oDgyVZo.exe
        5⤵
        
        PID:18308
    - - C:\Windows\System\gNjCdpe.exe
        
        C:\Windows\System\gNjCdpe.exe
        5⤵
        
        PID:18352
    - - C:\Windows\System\zSXbymh.exe
        
        C:\Windows\System\zSXbymh.exe
        5⤵
        
        PID:18400
    - - C:\Windows\System\vSdTfaL.exe
        
        C:\Windows\System\vSdTfaL.exe
        5⤵
        
        PID:14560
    - - C:\Windows\System\CqUHTaP.exe
        
        C:\Windows\System\CqUHTaP.exe
        5⤵
        
        PID:11448
    - - C:\Windows\System\XUPlhRw.exe
        
        C:\Windows\System\XUPlhRw.exe
        5⤵
        
        PID:15296
  - - C:\Users\Admin\Downloads\240919-qtr77s1gkl_f9269ca0133281a9282fa29b4f300a7e716dcb261968ab82f318e8885314d5f2N.exe
      C:\Users\Admin\Downloads\240919-qtr77s1gkl_f9269ca0133281a9282fa29b4f300a7e716dcb261968ab82f318e8885314d5f2N.exe
      4⤵
      PID:5268
  - - C:\Users\Admin\Downloads\240919-p9y51szglp_2748-0-0x0000000000400000-0x0000000000643000-memory.dmp
      C:\Users\Admin\Downloads\240919-p9y51szglp_2748-0-0x0000000000400000-0x0000000000643000-memory.dmp
      4⤵
      PID:4804
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4804 -s 216
        5⤵
        Program crash
        
        PID:14956
  - - C:\Users\Admin\Downloads\240919-qpsyya1eln_dee41ddf2c8fb1f56692a2d63b23cf4f0de40c42fb87a86af7d125865d0d60b0N.exe
      C:\Users\Admin\Downloads\240919-qpsyya1eln_dee41ddf2c8fb1f56692a2d63b23cf4f0de40c42fb87a86af7d125865d0d60b0N.exe
      4⤵
      PID:3696
    - - C:\Windows\SysWOW64\Nbnlaldg.exe
        
        C:\Windows\system32\Nbnlaldg.exe
        5⤵
        
        PID:5604
      - C:\Windows\SysWOW64\Oqhoeb32.exe
        
        C:\Windows\system32\Oqhoeb32.exe
        6⤵
        
        PID:6232
        
        C:\Windows\SysWOW64\Ojemig32.exe
        
        C:\Windows\system32\Ojemig32.exe
        7⤵
        
        PID:6644
        
        C:\Windows\SysWOW64\Pidlqb32.exe
        
        C:\Windows\system32\Pidlqb32.exe
        8⤵
        
        PID:8864
        
        C:\Windows\SysWOW64\Edoencdm.exe
        
        C:\Windows\system32\Edoencdm.exe
        9⤵
        
        PID:7336
        
        C:\Windows\SysWOW64\Iaedanal.exe
        
        C:\Windows\system32\Iaedanal.exe
        10⤵
        
        PID:13604
        
        C:\Windows\SysWOW64\Jdalog32.exe
        
        C:\Windows\system32\Jdalog32.exe
        11⤵
        
        PID:10928
        
        C:\Windows\SysWOW64\Mkocol32.exe
        
        C:\Windows\system32\Mkocol32.exe
        12⤵
        
        PID:15968
        
        C:\Windows\SysWOW64\Oljoen32.exe
        
        C:\Windows\system32\Oljoen32.exe
        13⤵
        
        PID:14204
        
        C:\Windows\SysWOW64\Ocmjhfjl.exe
        
        C:\Windows\system32\Ocmjhfjl.exe
        14⤵
        
        PID:15032
        
        C:\Windows\SysWOW64\Piaiqlak.exe
        
        C:\Windows\system32\Piaiqlak.exe
        15⤵
        
        PID:11244
        
        C:\Windows\SysWOW64\Bfjllnnm.exe
        
        C:\Windows\system32\Bfjllnnm.exe
        16⤵
        
        PID:18156
  - - C:\Users\Admin\Downloads\240919-qmlrvazgma_3304074548dd4268954244688bac21e34b9c7159177ff40f1db462d4e239a127N.exe
      C:\Users\Admin\Downloads\240919-qmlrvazgma_3304074548dd4268954244688bac21e34b9c7159177ff40f1db462d4e239a127N.exe
      4⤵
      PID:5260
    - - C:\Windows\SysWOW64\Njljch32.exe
        
        C:\Windows\system32\Njljch32.exe
        5⤵
        
        PID:5908
      - C:\Windows\SysWOW64\Pififb32.exe
        
        C:\Windows\system32\Pififb32.exe
        6⤵
        
        PID:7424
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7424 -s 400
        7⤵
        Program crash
        
        PID:15924
  - - C:\Users\Admin\Downloads\240919-qapb7szgpm_bc503f0ad9e62ff083ba7eb4a69001668628f254be67c7e2b17971b48859fb2aN.exe
      C:\Users\Admin\Downloads\240919-qapb7szgpm_bc503f0ad9e62ff083ba7eb4a69001668628f254be67c7e2b17971b48859fb2aN.exe
      4⤵
      PID:6152
    - - C:\Windows\SysWOW64\Ockdmmoj.exe
        
        C:\Windows\system32\Ockdmmoj.exe
        5⤵
        
        PID:6528
      - C:\Windows\SysWOW64\Paihlpfi.exe
        
        C:\Windows\system32\Paihlpfi.exe
        6⤵
        
        PID:4112
        
        C:\Windows\SysWOW64\Ekngemhd.exe
        
        C:\Windows\system32\Ekngemhd.exe
        7⤵
        
        PID:10524
        
        C:\Windows\SysWOW64\Gnohnffc.exe
        
        C:\Windows\system32\Gnohnffc.exe
        8⤵
        
        PID:11932
        
        C:\Windows\SysWOW64\Ibpgqa32.exe
        
        C:\Windows\system32\Ibpgqa32.exe
        9⤵
        
        PID:9936
        
        C:\Windows\SysWOW64\Jdjfohjg.exe
        
        C:\Windows\system32\Jdjfohjg.exe
        10⤵
        
        PID:14176
        
        C:\Windows\SysWOW64\Lhmafcnf.exe
        
        C:\Windows\system32\Lhmafcnf.exe
        11⤵
        
        PID:7368
        
        C:\Windows\SysWOW64\Mllccpfj.exe
        
        C:\Windows\system32\Mllccpfj.exe
        12⤵
        
        PID:15900
        
        C:\Windows\SysWOW64\Omcbkl32.exe
        
        C:\Windows\system32\Omcbkl32.exe
        13⤵
        
        PID:6572
        
        C:\Windows\SysWOW64\Bldgoeog.exe
        
        C:\Windows\system32\Bldgoeog.exe
        14⤵
        
        PID:17960
  - - C:\Users\Admin\Downloads\240919-qle8ns1crk_eb6a6d7569cdeac7cc12223dda7b73f9_JaffaCakes118.exe
      C:\Users\Admin\Downloads\240919-qle8ns1crk_eb6a6d7569cdeac7cc12223dda7b73f9_JaffaCakes118.exe
      4⤵
      PID:6856
    - - C:\Users\Admin\Downloads\240919-qle8ns1crk_eb6a6d7569cdeac7cc12223dda7b73f9_JaffaCakes118.exe
        
        "C:\Users\Admin\Downloads\240919-qle8ns1crk_eb6a6d7569cdeac7cc12223dda7b73f9_JaffaCakes118.exe"
        5⤵
        
        PID:12448
      - C:\Users\Admin\AppData\Roaming\hostsys.exe
        
        "C:\Users\Admin\AppData\Roaming\hostsys.exe"
        6⤵
        
        PID:12756
  - - C:\Users\Admin\Downloads\240919-qchx7szcqc_ac443eeba8fba22417e4156119c627d7c7036668e8171876cb1f1e7b7a8ba6aeN.exe
      C:\Users\Admin\Downloads\240919-qchx7szcqc_ac443eeba8fba22417e4156119c627d7c7036668e8171876cb1f1e7b7a8ba6aeN.exe
      4⤵
      PID:6716
    - - C:\Windows\SysWOW64\Ekngemhd.exe
        
        C:\Windows\system32\Ekngemhd.exe
        5⤵
        
        PID:10552
      - C:\Windows\SysWOW64\Gjcmngnj.exe
        
        C:\Windows\system32\Gjcmngnj.exe
        6⤵
        
        PID:11884
        
        C:\Windows\SysWOW64\Ijiopd32.exe
        
        C:\Windows\system32\Ijiopd32.exe
        7⤵
        
        PID:9780
        
        C:\Windows\SysWOW64\Klgqabib.exe
        
        C:\Windows\system32\Klgqabib.exe
        8⤵
        
        PID:15316
        
        C:\Windows\SysWOW64\Ncmaai32.exe
        
        C:\Windows\system32\Ncmaai32.exe
        9⤵
        
        PID:7276
  - - C:\Users\Admin\Downloads\240919-p9kmmazgkj_Bh2PmThP.exe
      C:\Users\Admin\Downloads\240919-p9kmmazgkj_Bh2PmThP.exe
      4⤵
      PID:5364
  - - C:\Users\Admin\Downloads\240919-p9plkszgkp_209b294dc2e6dd049b08329565e489f19115007db3332aa7b52be27e8d646a2eN.exe
      C:\Users\Admin\Downloads\240919-p9plkszgkp_209b294dc2e6dd049b08329565e489f19115007db3332aa7b52be27e8d646a2eN.exe
      4⤵
      PID:2720
    - - C:\Windows\SysWOW64\Dckoia32.exe
        
        C:\Windows\system32\Dckoia32.exe
        5⤵
        
        PID:9668
      - C:\Windows\SysWOW64\Eahobg32.exe
        
        C:\Windows\system32\Eahobg32.exe
        6⤵
        
        PID:10652
        
        C:\Windows\SysWOW64\Gcjdam32.exe
        
        C:\Windows\system32\Gcjdam32.exe
        7⤵
        
        PID:11768
        
        C:\Windows\SysWOW64\Icogcjde.exe
        
        C:\Windows\system32\Icogcjde.exe
        8⤵
        
        PID:14124
        
        C:\Windows\SysWOW64\Mohbjkgp.exe
        
        C:\Windows\system32\Mohbjkgp.exe
        9⤵
        
        PID:15712
        
        C:\Windows\SysWOW64\Ncmaai32.exe
        
        C:\Windows\system32\Ncmaai32.exe
        10⤵
        
        PID:11672
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 11672 -s 376
        11⤵
        Program crash
        
        PID:4504
  - - C:\Users\Admin\Downloads\240919-qpy5yszhme_2024-09-19_53957c9719c6574eafbf32ffc7ca0ab6_virlock.exe
      C:\Users\Admin\Downloads\240919-qpy5yszhme_2024-09-19_53957c9719c6574eafbf32ffc7ca0ab6_virlock.exe
      4⤵
      PID:5092
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Downloads\240919-qpy5yszhme_2024-09-19_53957c9719c6574eafbf32ffc7ca0ab6_virlock"
        5⤵
        
        PID:10500
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        5⤵
        Modifies registry key
        
        PID:12240
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        5⤵
        Modifies registry key
        
        PID:12248
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        5⤵
        Modifies registry key
        
        PID:12256
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\LEIkokoI.bat" "C:\Users\Admin\Downloads\240919-qpy5yszhme_2024-09-19_53957c9719c6574eafbf32ffc7ca0ab6_virlock.exe""
        5⤵
        
        PID:12272
  - - C:\Users\Admin\Downloads\240919-p9djbazbmh_a79192dbf55c6a02986536541f49a0f93038fcbaa7f5d7f6ad4fb211163fb01bN.exe
      C:\Users\Admin\Downloads\240919-p9djbazbmh_a79192dbf55c6a02986536541f49a0f93038fcbaa7f5d7f6ad4fb211163fb01bN.exe
      4⤵
      PID:1664
    - - C:\Windows\SysWOW64\Dphiaffa.exe
        
        C:\Windows\system32\Dphiaffa.exe
        5⤵
        
        PID:9704
      - C:\Windows\SysWOW64\Gqkhda32.exe
        
        C:\Windows\system32\Gqkhda32.exe
        6⤵
        
        PID:11704
        
        C:\Windows\SysWOW64\Iapjgo32.exe
        
        C:\Windows\system32\Iapjgo32.exe
        7⤵
        
        PID:9460
        
        C:\Windows\SysWOW64\Kdpiqehp.exe
        
        C:\Windows\system32\Kdpiqehp.exe
        8⤵
        
        PID:15252
        
        C:\Windows\SysWOW64\Mlemcq32.exe
        
        C:\Windows\system32\Mlemcq32.exe
        9⤵
        
        PID:14272
        
        C:\Windows\SysWOW64\Nooikj32.exe
        
        C:\Windows\system32\Nooikj32.exe
        10⤵
        
        PID:16380
        
        C:\Windows\SysWOW64\Obkahddl.exe
        
        C:\Windows\system32\Obkahddl.exe
        11⤵
        
        PID:14468
        
        C:\Windows\SysWOW64\Pbddobla.exe
        
        C:\Windows\system32\Pbddobla.exe
        12⤵
        
        PID:12268
        
        C:\Windows\SysWOW64\Akihcfid.exe
        
        C:\Windows\system32\Akihcfid.exe
        13⤵
        
        PID:16944
  - - C:\Users\Admin\Downloads\240919-qstpms1fqm_eb6f77a1338144f6c63a55ed5e8a79c0_JaffaCakes118.exe
      C:\Users\Admin\Downloads\240919-qstpms1fqm_eb6f77a1338144f6c63a55ed5e8a79c0_JaffaCakes118.exe
      4⤵
      PID:1864
  - - C:\Users\Admin\Downloads\240919-qry8qs1apd_eb6e9654185ff9039aa2ba87cadfe45b_JaffaCakes118.exe
      C:\Users\Admin\Downloads\240919-qry8qs1apd_eb6e9654185ff9039aa2ba87cadfe45b_JaffaCakes118.exe
      4⤵
      PID:952
  - - C:\Users\Admin\Downloads\240919-qpfzda1ekm_1aa3a4710f95a8eb843b713e93cdd6fb68d44612305f701d8f622dac92889a02N.exe
      C:\Users\Admin\Downloads\240919-qpfzda1ekm_1aa3a4710f95a8eb843b713e93cdd6fb68d44612305f701d8f622dac92889a02N.exe
      4⤵
      PID:6508
    - - C:\Windows\SysWOW64\Ejagaj32.exe
        
        C:\Windows\system32\Ejagaj32.exe
        5⤵
        
        PID:10604
      - C:\Windows\SysWOW64\Gkalbj32.exe
        
        C:\Windows\system32\Gkalbj32.exe
        6⤵
        
        PID:11832
        
        C:\Windows\SysWOW64\Ilfodgeg.exe
        
        C:\Windows\system32\Ilfodgeg.exe
        7⤵
        
        PID:9652
        
        C:\Windows\SysWOW64\Mlifnphl.exe
        
        C:\Windows\system32\Mlifnphl.exe
        8⤵
        
        PID:15608
        
        C:\Windows\SysWOW64\Ndlacapp.exe
        
        C:\Windows\system32\Ndlacapp.exe
        9⤵
        
        PID:7876
        
        C:\Windows\SysWOW64\Acbmjcgd.exe
        
        C:\Windows\system32\Acbmjcgd.exe
        10⤵
        
        PID:17256
        
        C:\Windows\SysWOW64\Blknpdho.exe
        
        C:\Windows\system32\Blknpdho.exe
        11⤵
        
        PID:18472
  - - C:\Users\Admin\Downloads\240919-qc1s1szhpj_cae4537b81951e1c349e26ef5b4ad4fd8411e4713dd5f539559d813db28c4e68N.exe
      C:\Users\Admin\Downloads\240919-qc1s1szhpj_cae4537b81951e1c349e26ef5b4ad4fd8411e4713dd5f539559d813db28c4e68N.exe
      4⤵
      PID:6544
    - - C:\Windows\SysWOW64\Dkpjdo32.exe
        
        C:\Windows\system32\Dkpjdo32.exe
        5⤵
        
        PID:9536
      - C:\Windows\SysWOW64\Gqnejaff.exe
        
        C:\Windows\system32\Gqnejaff.exe
        6⤵
        
        PID:12004
        
        C:\Windows\SysWOW64\Iabglnco.exe
        
        C:\Windows\system32\Iabglnco.exe
        7⤵
        
        PID:13316
        
        C:\Windows\SysWOW64\Jdjfohjg.exe
        
        C:\Windows\system32\Jdjfohjg.exe
        8⤵
        
        PID:14164
        
        C:\Windows\SysWOW64\Mohbjkgp.exe
        
        C:\Windows\system32\Mohbjkgp.exe
        9⤵
        
        PID:15684
        
        C:\Windows\SysWOW64\Ncmaai32.exe
        
        C:\Windows\system32\Ncmaai32.exe
        10⤵
        
        PID:10296
        
        C:\Windows\SysWOW64\Alpnde32.exe
        
        C:\Windows\system32\Alpnde32.exe
        11⤵
        
        PID:13232
  - - C:\Users\Admin\Downloads\240919-qbty3szcmh_eb649f905b80b143b6637a1561b320ab_JaffaCakes118.exe
      C:\Users\Admin\Downloads\240919-qbty3szcmh_eb649f905b80b143b6637a1561b320ab_JaffaCakes118.exe
      4⤵
      PID:6300
  - - C:\Users\Admin\Downloads\240919-qndsma1dqk_a03b3adfc179ffbbfcc8adfb711b667b7c95578e7f564fe8aba9e355cc71f563N.exe
      C:\Users\Admin\Downloads\240919-qndsma1dqk_a03b3adfc179ffbbfcc8adfb711b667b7c95578e7f564fe8aba9e355cc71f563N.exe
      4⤵
      PID:1640
    - - C:\Windows\SysWOW64\Dpjfgf32.exe
        
        C:\Windows\system32\Dpjfgf32.exe
        5⤵
        
        PID:9436
      - C:\Windows\SysWOW64\Ephbhd32.exe
        
        C:\Windows\system32\Ephbhd32.exe
        6⤵
        
        PID:10396
        
        C:\Windows\SysWOW64\Gggmgk32.exe
        
        C:\Windows\system32\Gggmgk32.exe
        7⤵
        
        PID:12148
        
        C:\Windows\SysWOW64\Igmoih32.exe
        
        C:\Windows\system32\Igmoih32.exe
        8⤵
        
        PID:13444
        
        C:\Windows\SysWOW64\Jlanpfkj.exe
        
        C:\Windows\system32\Jlanpfkj.exe
        9⤵
        
        PID:14244
        
        C:\Windows\SysWOW64\Mafofggd.exe
        
        C:\Windows\system32\Mafofggd.exe
        10⤵
        
        PID:15784
        
        C:\Windows\SysWOW64\Ndnnianm.exe
        
        C:\Windows\system32\Ndnnianm.exe
        11⤵
        
        PID:14628
        
        C:\Windows\SysWOW64\Ammnhilb.exe
        
        C:\Windows\system32\Ammnhilb.exe
        12⤵
        
        PID:13896
  - - C:\Users\Admin\Downloads\240919-qmwl2szgmg_6e63ee42f755efcd5f80c9192e2b815c9e0769624a63ef79814fa5b38735c091N.exe
      C:\Users\Admin\Downloads\240919-qmwl2szgmg_6e63ee42f755efcd5f80c9192e2b815c9e0769624a63ef79814fa5b38735c091N.exe
      4⤵
      PID:7200
    - - C:\Windows\SysWOW64\Daeifj32.exe
        
        C:\Windows\system32\Daeifj32.exe
        5⤵
        
        PID:8832
      - C:\Windows\SysWOW64\Ecdbop32.exe
        
        C:\Windows\system32\Ecdbop32.exe
        6⤵
        
        PID:2256
        
        C:\Windows\SysWOW64\Fbdnne32.exe
        
        C:\Windows\system32\Fbdnne32.exe
        7⤵
        
        PID:11276
        
        C:\Windows\SysWOW64\Idhiii32.exe
        
        C:\Windows\system32\Idhiii32.exe
        8⤵
        
        PID:13808
        
        C:\Windows\SysWOW64\Kkgdhp32.exe
        
        C:\Windows\system32\Kkgdhp32.exe
        9⤵
        
        PID:15136
        
        C:\Windows\SysWOW64\Ldkhlcnb.exe
        
        C:\Windows\system32\Ldkhlcnb.exe
        10⤵
        
        PID:12640
        
        C:\Windows\SysWOW64\Oomelheh.exe
        
        C:\Windows\system32\Oomelheh.exe
        11⤵
        
        PID:12516
        
        C:\Windows\SysWOW64\Acppddig.exe
        
        C:\Windows\system32\Acppddig.exe
        12⤵
        
        PID:17020
        
        C:\Windows\SysWOW64\Bfoegm32.exe
        
        C:\Windows\system32\Bfoegm32.exe
        13⤵
        
        PID:10924
        
        C:\Windows\SysWOW64\Cmbpjfij.exe
        
        C:\Windows\system32\Cmbpjfij.exe
        14⤵
        
        PID:19004
        
        C:\Windows\SysWOW64\Dpgbgpbe.exe
        
        C:\Windows\system32\Dpgbgpbe.exe
        15⤵
        
        PID:19396
  - - C:\Users\Admin\Downloads\240919-p8aq2azfmr_AscoValveShanghaiOrderPO011024.exe
      C:\Users\Admin\Downloads\240919-p8aq2azfmr_AscoValveShanghaiOrderPO011024.exe
      4⤵
      PID:7216
  - - C:\Users\Admin\Downloads\240919-p889lazgjj_eb62f23721e0f5641593bf64232d8cb6_JaffaCakes118.exe
      C:\Users\Admin\Downloads\240919-p889lazgjj_eb62f23721e0f5641593bf64232d8cb6_JaffaCakes118.exe
      4⤵
      PID:6348
  - - C:\Users\Admin\Downloads\240919-qdnj3szdla_793f5d7a2aa6cc5b32e394bd3a605ae45568b19026e0c3866b260a51170e17c5N.exe
      C:\Users\Admin\Downloads\240919-qdnj3szdla_793f5d7a2aa6cc5b32e394bd3a605ae45568b19026e0c3866b260a51170e17c5N.exe
      4⤵
      PID:6368
  - - C:\Users\Admin\Downloads\240919-p763vazbje_3468-1-0x0000000000400000-0x0000000000643000-memory.dmp
      C:\Users\Admin\Downloads\240919-p763vazbje_3468-1-0x0000000000400000-0x0000000000643000-memory.dmp
      4⤵
      PID:6792
  - - C:\Users\Admin\Downloads\240919-qnjnwa1dqm_eb6ba0e5a2827863f759f8433f6d0ed9_JaffaCakes118.exe
      C:\Users\Admin\Downloads\240919-qnjnwa1dqm_eb6ba0e5a2827863f759f8433f6d0ed9_JaffaCakes118.exe
      4⤵
      PID:5568
    - - C:\Windows\splwow64.exe
        
        C:\Windows\splwow64.exe 12288
        5⤵
        
        PID:17264
  - - C:\Users\Admin\Downloads\240919-p8rpjszfpq_a77fbce2dac30c9eaf46be5dd73a787184d63003c9d1f3cd60ee281d24fe1833N.exe
      C:\Users\Admin\Downloads\240919-p8rpjszfpq_a77fbce2dac30c9eaf46be5dd73a787184d63003c9d1f3cd60ee281d24fe1833N.exe
      4⤵
      PID:6936
    - - C:\Windows\SysWOW64\Ddfbgelh.exe
        
        C:\Windows\system32\Ddfbgelh.exe
        5⤵
        
        PID:9452
      - C:\Windows\SysWOW64\Eddnic32.exe
        
        C:\Windows\system32\Eddnic32.exe
        6⤵
        
        PID:10428
        
        C:\Windows\SysWOW64\Gdiakp32.exe
        
        C:\Windows\system32\Gdiakp32.exe
        7⤵
        
        PID:12052
        
        C:\Windows\SysWOW64\Iencmm32.exe
        
        C:\Windows\system32\Iencmm32.exe
        8⤵
        
        PID:13372
        
        C:\Windows\SysWOW64\Odbgdp32.exe
        
        C:\Windows\system32\Odbgdp32.exe
        9⤵
        
        PID:15472
        
        C:\Windows\SysWOW64\Pbgqdb32.exe
        
        C:\Windows\system32\Pbgqdb32.exe
        10⤵
        
        PID:7180
        
        C:\Windows\SysWOW64\Bppcpc32.exe
        
        C:\Windows\system32\Bppcpc32.exe
        11⤵
        
        PID:18036
        
        C:\Windows\SysWOW64\Defheg32.exe
        
        C:\Windows\system32\Defheg32.exe
        12⤵
        
        PID:17752
  - - C:\Users\Admin\Downloads\240919-qargkazgpp_eb63df874af3c40abe3e518733a53063_JaffaCakes118.exe
      C:\Users\Admin\Downloads\240919-qargkazgpp_eb63df874af3c40abe3e518733a53063_JaffaCakes118.exe
      4⤵
      PID:7048
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
        5⤵
        
        PID:12968
    - - C:\Windows\SysWOW64\net.exe
        
        net.exe start schedule /y
        5⤵
        
        PID:13760
    - - C:\Windows\SysWOW64\At.exe
        
        At.exe 1:40:51 PM C:\Windows\Help\HelpCat.exe
        5⤵
        
        PID:16316
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c at 1:39:53 PM C:\Windows\Sysinf.bat
        5⤵
        
        PID:16328
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c at 1:42:53 PM C:\Windows\Sysinf.bat
        5⤵
        
        PID:16336
    - - C:\Windows\SysWOW64\net.exe
        
        net.exe stop wscsvc /y
        5⤵
        
        PID:16344
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop wscsvc /y
        6⤵
        
        PID:13256
    - - C:\Windows\SysWOW64\net.exe
        
        net.exe stop sharedaccess /y
        5⤵
        
        PID:14340
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop sharedaccess /y
        6⤵
        
        PID:15844
    - - C:\Windows\SysWOW64\net.exe
        
        net.exe stop wuauserv /y
        5⤵
        
        PID:11588
    - - C:\Windows\SysWOW64\net.exe
        
        net.exe stop srservice /y
        5⤵
        
        PID:17068
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop srservice /y
        6⤵
        
        PID:8660
    - - C:\Windows\SysWOW64\sc.exe
        
        C:\Windows\system32\sc.exe config srservice start= disabled
        5⤵
        Launches sc.exe
        
        PID:18976
    - - C:\Windows\SysWOW64\sc.exe
        
        C:\Windows\system32\sc.exe config SharedAccess start= disabled
        5⤵
        Launches sc.exe
        
        PID:19352
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:4000
    - - C:\Windows\SysWOW64\sc.exe
        
        C:\Windows\system32\sc.exe config srservice start= disabled
        5⤵
        Launches sc.exe
        
        PID:18072
    - - C:\Windows\SysWOW64\regedit.exe
        
        regedit.exe /s C:\Windows\regedt32.sys
        5⤵
        Runs regedit.exe
        
        PID:18044
    - - C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\system32\reg.exe delete "hklm\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318}" /f
        5⤵
        
        PID:13892
    - - C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\system32\reg.exe delete "hklm\SYSTEM\ControlSet001\Control\SafeBoot\Network\{4D36E967-E325-11CE-BFC1-08002BE10318}" /f
        5⤵
        
        PID:15356
    - - C:\Windows\system\KavUpda.exe
        
        C:\Windows\system\KavUpda.exe
        5⤵
        
        PID:17144
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
        6⤵
        
        PID:12216
      - C:\Windows\SysWOW64\net.exe
        
        net.exe start schedule /y
        6⤵
        
        PID:14736
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start schedule /y
        7⤵
        
        PID:15136
  - - C:\Users\Admin\Downloads\240919-qnnb3azgpg_ba0176d67ffe059df3d725eead17fda259079fc5427bd512f515aa9b32b9293dN.exe
      C:\Users\Admin\Downloads\240919-qnnb3azgpg_ba0176d67ffe059df3d725eead17fda259079fc5427bd512f515aa9b32b9293dN.exe
      4⤵
      PID:3200
    - - C:\Windows\SysWOW64\Dahfkimd.exe
        
        C:\Windows\system32\Dahfkimd.exe
        5⤵
        
        PID:9356
      - C:\Windows\SysWOW64\Gclafmej.exe
        
        C:\Windows\system32\Gclafmej.exe
        6⤵
        
        PID:12100
        
        C:\Windows\SysWOW64\Icachjbb.exe
        
        C:\Windows\system32\Icachjbb.exe
        7⤵
        
        PID:13404
        
        C:\Windows\SysWOW64\Llimgb32.exe
        
        C:\Windows\system32\Llimgb32.exe
        8⤵
        
        PID:11636
        
        C:\Windows\SysWOW64\Mkocol32.exe
        
        C:\Windows\system32\Mkocol32.exe
        9⤵
        
        PID:15940
        
        C:\Windows\SysWOW64\Oljoen32.exe
        
        C:\Windows\system32\Oljoen32.exe
        10⤵
        
        PID:14320
        
        C:\Windows\SysWOW64\Ocmjhfjl.exe
        
        C:\Windows\system32\Ocmjhfjl.exe
        11⤵
        
        PID:15116
        
        C:\Windows\SysWOW64\Pkoemhao.exe
        
        C:\Windows\system32\Pkoemhao.exe
        12⤵
        
        PID:13300
        
        C:\Windows\SysWOW64\Bihhhi32.exe
        
        C:\Windows\system32\Bihhhi32.exe
        13⤵
        
        PID:18256
  - - C:\Users\Admin\Downloads\240919-qjm6hazfjf_eb695933b2dfcc0e4839680fe031406c_JaffaCakes118.exe
      C:\Users\Admin\Downloads\240919-qjm6hazfjf_eb695933b2dfcc0e4839680fe031406c_JaffaCakes118.exe
      4⤵
      PID:12368
  - - C:\Users\Admin\Downloads\240919-p6qpgazeqk_e080c60f276640ba6e0143283bd9eb202701663faab12a947552263de8d01681N.exe
      C:\Users\Admin\Downloads\240919-p6qpgazeqk_e080c60f276640ba6e0143283bd9eb202701663faab12a947552263de8d01681N.exe
      4⤵
      PID:13664
    - - C:\Windows\SysWOW64\Jjkdlall.exe
        
        C:\Windows\system32\Jjkdlall.exe
        5⤵
        
        PID:11064
      - C:\Windows\SysWOW64\Mojopk32.exe
        
        C:\Windows\system32\Mojopk32.exe
        6⤵
        
        PID:15992
        
        C:\Windows\SysWOW64\Ohncdobq.exe
        
        C:\Windows\system32\Ohncdobq.exe
        7⤵
        
        PID:15592
        
        C:\Windows\SysWOW64\Ocmjhfjl.exe
        
        C:\Windows\system32\Ocmjhfjl.exe
        8⤵
        
        PID:15088
        
        C:\Windows\SysWOW64\Pmmeak32.exe
        
        C:\Windows\system32\Pmmeak32.exe
        9⤵
        
        PID:352
        
        C:\Windows\SysWOW64\Bemlhj32.exe
        
        C:\Windows\system32\Bemlhj32.exe
        10⤵
        
        PID:18208
        
        C:\Windows\SysWOW64\Cpifeb32.exe
        
        C:\Windows\system32\Cpifeb32.exe
        11⤵
        
        PID:18756
        
        C:\Windows\SysWOW64\Defheg32.exe
        
        C:\Windows\system32\Defheg32.exe
        12⤵
        
        PID:17836
        
        C:\Windows\SysWOW64\Dmbiackg.exe
        
        C:\Windows\system32\Dmbiackg.exe
        13⤵
        
        PID:17424
        
        C:\Windows\SysWOW64\Ecfhji32.exe
        
        C:\Windows\system32\Ecfhji32.exe
        14⤵
        
        PID:17188
        
        C:\Windows\SysWOW64\Fcbgfhii.exe
        
        C:\Windows\system32\Fcbgfhii.exe
        15⤵
        
        PID:6016
        
        C:\Windows\SysWOW64\Gnlenp32.exe
        
        C:\Windows\system32\Gnlenp32.exe
        16⤵
        
        PID:19268
        
        C:\Windows\SysWOW64\Gckjlf32.exe
        
        C:\Windows\system32\Gckjlf32.exe
        17⤵
        
        PID:7492
        
        C:\Windows\SysWOW64\Gqagkjne.exe
        
        C:\Windows\system32\Gqagkjne.exe
        18⤵
        
        PID:12788
        
        C:\Windows\SysWOW64\Hmmakk32.exe
        
        C:\Windows\system32\Hmmakk32.exe
        19⤵
        
        PID:13440
        
        C:\Windows\SysWOW64\Ifjoop32.exe
        
        C:\Windows\system32\Ifjoop32.exe
        20⤵
        
        PID:11808
        
        C:\Windows\SysWOW64\Iqgjmg32.exe
        
        C:\Windows\system32\Iqgjmg32.exe
        21⤵
        
        PID:17108
        
        C:\Windows\SysWOW64\Imnjbhaa.exe
        
        C:\Windows\system32\Imnjbhaa.exe
        22⤵
        
        PID:3700
        
        C:\Windows\SysWOW64\Jcjodbgl.exe
        
        C:\Windows\system32\Jcjodbgl.exe
        23⤵
        
        PID:18676
        
        C:\Windows\SysWOW64\Jclljaei.exe
        
        C:\Windows\system32\Jclljaei.exe
        24⤵
        
        PID:2468
        
        C:\Windows\SysWOW64\Jaefne32.exe
        
        C:\Windows\system32\Jaefne32.exe
        25⤵
        
        PID:18328
        
        C:\Windows\SysWOW64\Kagbdenk.exe
        
        C:\Windows\system32\Kagbdenk.exe
        26⤵
        
        PID:13360
        
        C:\Windows\SysWOW64\Kjpgmj32.exe
        
        C:\Windows\system32\Kjpgmj32.exe
        27⤵
        
        PID:17680
        
        C:\Windows\SysWOW64\Kdhlepkl.exe
        
        C:\Windows\system32\Kdhlepkl.exe
        28⤵
        
        PID:15384
        
        C:\Windows\SysWOW64\Kfidgk32.exe
        
        C:\Windows\system32\Kfidgk32.exe
        29⤵
        
        PID:18580
        
        C:\Windows\SysWOW64\Kdmeqo32.exe
        
        C:\Windows\system32\Kdmeqo32.exe
        30⤵
        
        PID:5008
        
        C:\Windows\SysWOW64\Knbinhfl.exe
        
        C:\Windows\system32\Knbinhfl.exe
        31⤵
        
        PID:14212
        
        C:\Windows\SysWOW64\Ldoafodd.exe
        
        C:\Windows\system32\Ldoafodd.exe
        32⤵
        
        PID:13960
        
        C:\Windows\SysWOW64\Ljijci32.exe
        
        C:\Windows\system32\Ljijci32.exe
        33⤵
        
        PID:6516
  - - C:\Users\Admin\Downloads\240919-qsqmzs1fpr_34e8ac3bd8264bf5915c4bdbd7317bd369a1c60548f3bf18ddb12f0780593208.exe
      C:\Users\Admin\Downloads\240919-qsqmzs1fpr_34e8ac3bd8264bf5915c4bdbd7317bd369a1c60548f3bf18ddb12f0780593208.exe
      4⤵
      PID:14748
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        C:\Users\Admin\Downloads\240919-qsqmzs1fpr_34e8ac3bd8264bf5915c4bdbd7317bd369a1c60548f3bf18ddb12f0780593208.exe
        5⤵
        
        PID:16588
  - - C:\Users\Admin\Downloads\240919-qpfnlszhkd_eb6c96d14f79167204b518721dbfa5fd_JaffaCakes118.exe
      C:\Users\Admin\Downloads\240919-qpfnlszhkd_eb6c96d14f79167204b518721dbfa5fd_JaffaCakes118.exe
      4⤵
      PID:7416
  - - C:\Users\Admin\Downloads\240919-p662fszapc_e53f62bb5d22ad10106c1a28cc4caa6b4092e502b9c741797834a4a9ad0d2932N.exe
      C:\Users\Admin\Downloads\240919-p662fszapc_e53f62bb5d22ad10106c1a28cc4caa6b4092e502b9c741797834a4a9ad0d2932N.exe
      4⤵
      PID:11716
    - - C:\Windows\SysWOW64\Apkjddke.exe
        
        C:\Windows\system32\Apkjddke.exe
        5⤵
        
        PID:17428
  - - C:\Users\Admin\Downloads\240919-qnt5ls1drp_c9babc7ce04e1bab2cf1a7c5f4a6719fe6a2f1921f22eacfe3075bef1ff8b511N.exe
      C:\Users\Admin\Downloads\240919-qnt5ls1drp_c9babc7ce04e1bab2cf1a7c5f4a6719fe6a2f1921f22eacfe3075bef1ff8b511N.exe
      4⤵
      PID:19424
  - - C:\Users\Admin\Downloads\240919-qjx1ps1ckr_WizClient.exe
      C:\Users\Admin\Downloads\240919-qjx1ps1ckr_WizClient.exe
      4⤵
      PID:19432
  - - C:\Users\Admin\Downloads\240919-qd9gjszdmh_eb663c835aaab9d4989b1e322e53819f_JaffaCakes118.exe
      C:\Users\Admin\Downloads\240919-qd9gjszdmh_eb663c835aaab9d4989b1e322e53819f_JaffaCakes118.exe
      4⤵
      PID:17176
    - - C:\Users\Admin\Downloads\240919-qd9gjszdmh_eb663c835aaab9d4989b1e322e53819f_JaffaCakes118.exe
        
        C:\Users\Admin\Downloads\240919-qd9gjszdmh_eb663c835aaab9d4989b1e322e53819f_JaffaCakes118.exe startC:\Program Files (x86)\LP\D3AB\938.exe%C:\Program Files (x86)\LP\D3AB
        5⤵
        
        PID:13088
  - - C:\Users\Admin\Downloads\240919-qryxza1fmk_da4b87fed4fd91b8a0ef9fcc4315032c87cd4902fc2e3a3e4bf049eb8af3ef20N.exe
      C:\Users\Admin\Downloads\240919-qryxza1fmk_da4b87fed4fd91b8a0ef9fcc4315032c87cd4902fc2e3a3e4bf049eb8af3ef20N.exe
      4⤵
      PID:17380
  - - C:\Users\Admin\Downloads\240919-qlv9ws1djn_eb6ab67e8f25558ebb772e83dd87ff07_JaffaCakes118.exe
      C:\Users\Admin\Downloads\240919-qlv9ws1djn_eb6ab67e8f25558ebb772e83dd87ff07_JaffaCakes118.exe
      4⤵
      PID:12600
  - - C:\Users\Admin\Downloads\240919-qaah2szbqf_eb639fec5df885c9bd9fa96c8b598857_JaffaCakes118.exe
      C:\Users\Admin\Downloads\240919-qaah2szbqf_eb639fec5df885c9bd9fa96c8b598857_JaffaCakes118.exe
      4⤵
      PID:10344
    - - C:\Windows\SysWOW64\wldap32.exe
        
        C:\Windows\system32\wldap32.exe
        5⤵
        
        PID:17352
  - - C:\Users\Admin\Downloads\240919-qeyfns1amk_90f42b1f295c3a36e64186dbe606d26c68a749ad485b9f9acdd98a06a8967043N.exe
      C:\Users\Admin\Downloads\240919-qeyfns1amk_90f42b1f295c3a36e64186dbe606d26c68a749ad485b9f9acdd98a06a8967043N.exe
      4⤵
      PID:16308
  - - C:\Users\Admin\Downloads\240919-qmryvs1dml_Worm.Win32.Ludbaruma.pzca190b44f75e56c761bdac39808ba488b84d948ff761d21e7ebe66a430bc9727N
      C:\Users\Admin\Downloads\240919-qmryvs1dml_Worm.Win32.Ludbaruma.pzca190b44f75e56c761bdac39808ba488b84d948ff761d21e7ebe66a430bc9727N
      4⤵
      PID:6472
  - - C:\Users\Admin\Downloads\240919-p6s5lazeqq_5b1f99c348dd8cc47a4b65e1a26f86a92b8bf1008a96e8ad9efc8d1564e78913N.exe
      C:\Users\Admin\Downloads\240919-p6s5lazeqq_5b1f99c348dd8cc47a4b65e1a26f86a92b8bf1008a96e8ad9efc8d1564e78913N.exe
      4⤵
      PID:14924
  - - C:\Users\Admin\Downloads\240919-qtzbhs1bne_f42205f7e5a2313149ea0975377cb62ad50cee6dbf6c5672e2f9903d303ddd17N.exe
      C:\Users\Admin\Downloads\240919-qtzbhs1bne_f42205f7e5a2313149ea0975377cb62ad50cee6dbf6c5672e2f9903d303ddd17N.exe
      4⤵
      PID:17440
  - - C:\Users\Admin\Downloads\240919-qd9sbazdna_hesaphareketi-01.exe
      C:\Users\Admin\Downloads\240919-qd9sbazdna_hesaphareketi-01.exe
      4⤵
      PID:19064
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"
        5⤵
        
        PID:18768
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
        5⤵
        
        PID:10396
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
        5⤵
        
        PID:1568
  - - C:\Users\Admin\Downloads\240919-qd7yqa1ajp_ad58ddebec4af3ad876072b4f8222538461e79f20647d21fdfe9036bf8646fceN.exe
      C:\Users\Admin\Downloads\240919-qd7yqa1ajp_ad58ddebec4af3ad876072b4f8222538461e79f20647d21fdfe9036bf8646fceN.exe
      4⤵
      PID:15044
    - - C:\Windows\SysWOW64\Ggdigekj.exe
        
        C:\Windows\system32\Ggdigekj.exe
        5⤵
        
        PID:11580
      - C:\Windows\SysWOW64\Gcpcgfmi.exe
        
        C:\Windows\system32\Gcpcgfmi.exe
        6⤵
        
        PID:14000
        
        C:\Windows\SysWOW64\Hjlhipbc.exe
        
        C:\Windows\system32\Hjlhipbc.exe
        7⤵
        
        PID:15812
        
        C:\Windows\SysWOW64\Hjcojo32.exe
        
        C:\Windows\system32\Hjcojo32.exe
        8⤵
        
        PID:13608
        
        C:\Windows\SysWOW64\Imdgljil.exe
        
        C:\Windows\system32\Imdgljil.exe
        9⤵
        
        PID:12668
        
        C:\Windows\SysWOW64\Ijjekn32.exe
        
        C:\Windows\system32\Ijjekn32.exe
        10⤵
        
        PID:17316
        
        C:\Windows\SysWOW64\Iqdmghnp.exe
        
        C:\Windows\system32\Iqdmghnp.exe
        11⤵
        
        PID:2036
        
        C:\Windows\SysWOW64\Ijmapm32.exe
        
        C:\Windows\system32\Ijmapm32.exe
        12⤵
        
        PID:1852
        
        C:\Windows\SysWOW64\Igqbiacj.exe
        
        C:\Windows\system32\Igqbiacj.exe
        13⤵
        
        PID:14652
        
        C:\Windows\SysWOW64\Jcjodbgl.exe
        
        C:\Windows\system32\Jcjodbgl.exe
        14⤵
        
        PID:18112
        
        C:\Windows\SysWOW64\Jnocakfb.exe
        
        C:\Windows\system32\Jnocakfb.exe
        15⤵
        
        PID:17880
        
        C:\Windows\SysWOW64\Japmcfcc.exe
        
        C:\Windows\system32\Japmcfcc.exe
        16⤵
        
        PID:5380
        
        C:\Windows\SysWOW64\Jcaeea32.exe
        
        C:\Windows\system32\Jcaeea32.exe
        17⤵
        
        PID:15076
        
        C:\Windows\SysWOW64\Jmijnfgd.exe
        
        C:\Windows\system32\Jmijnfgd.exe
        18⤵
        
        PID:18016
        
        C:\Windows\SysWOW64\Khonkogj.exe
        
        C:\Windows\system32\Khonkogj.exe
        19⤵
        
        PID:17252
        
        C:\Windows\SysWOW64\Knifging.exe
        
        C:\Windows\system32\Knifging.exe
        20⤵
        
        PID:16232
        
        C:\Windows\SysWOW64\Khakqo32.exe
        
        C:\Windows\system32\Khakqo32.exe
        21⤵
        
        PID:5168
        
        C:\Windows\SysWOW64\Kjbdbjbi.exe
        
        C:\Windows\system32\Kjbdbjbi.exe
        22⤵
        
        PID:16372
        
        C:\Windows\SysWOW64\Kdjhkp32.exe
        
        C:\Windows\system32\Kdjhkp32.exe
        23⤵
        
        PID:12816
        
        C:\Windows\SysWOW64\Khhaanop.exe
        
        C:\Windows\system32\Khhaanop.exe
        24⤵
        
        PID:16304
  - - C:\Users\Admin\Downloads\240919-p6z8xazang_d3a8367782648aa359b4e48c01ad1291122fbde03d58f64bc5619bff0c9c7066N.exe
      C:\Users\Admin\Downloads\240919-p6z8xazang_d3a8367782648aa359b4e48c01ad1291122fbde03d58f64bc5619bff0c9c7066N.exe
      4⤵
      PID:18724
    - - C:\Windows\SysWOW64\Hnhdjn32.exe
        
        C:\Windows\system32\Hnhdjn32.exe
        5⤵
        
        PID:17028
      - C:\Windows\SysWOW64\Hfefdpfe.exe
        
        C:\Windows\system32\Hfefdpfe.exe
        6⤵
        
        PID:17024
        
        C:\Windows\SysWOW64\Imdgljil.exe
        
        C:\Windows\system32\Imdgljil.exe
        7⤵
        
        PID:13444
        
        C:\Windows\SysWOW64\Icciccmd.exe
        
        C:\Windows\system32\Icciccmd.exe
        8⤵
        
        PID:19032
        
        C:\Windows\SysWOW64\Imknli32.exe
        
        C:\Windows\system32\Imknli32.exe
        9⤵
        
        PID:18344
        
        C:\Windows\SysWOW64\Ifcben32.exe
        
        C:\Windows\system32\Ifcben32.exe
        10⤵
        
        PID:6544
        
        C:\Windows\SysWOW64\Jffokn32.exe
        
        C:\Windows\system32\Jffokn32.exe
        11⤵
        
        PID:11976
        
        C:\Windows\SysWOW64\Jjdgal32.exe
        
        C:\Windows\system32\Jjdgal32.exe
        12⤵
        
        PID:4456
        
        C:\Windows\SysWOW64\Japmcfcc.exe
        
        C:\Windows\system32\Japmcfcc.exe
        13⤵
        
        PID:6580
        
        C:\Windows\SysWOW64\Jgjeppkp.exe
        
        C:\Windows\system32\Jgjeppkp.exe
        14⤵
        
        PID:8840
        
        C:\Windows\SysWOW64\Jeneidji.exe
        
        C:\Windows\system32\Jeneidji.exe
        15⤵
        
        PID:17508
        
        C:\Windows\SysWOW64\Jmijnfgd.exe
        
        C:\Windows\system32\Jmijnfgd.exe
        16⤵
        
        PID:17268
        
        C:\Windows\SysWOW64\Knifging.exe
        
        C:\Windows\system32\Knifging.exe
        17⤵
        
        PID:14440
        
        C:\Windows\SysWOW64\Kffhakjp.exe
        
        C:\Windows\system32\Kffhakjp.exe
        18⤵
        
        PID:13948
        
        C:\Windows\SysWOW64\Kmppneal.exe
        
        C:\Windows\system32\Kmppneal.exe
        19⤵
        
        PID:12608
        
        C:\Windows\SysWOW64\Kdjhkp32.exe
        
        C:\Windows\system32\Kdjhkp32.exe
        20⤵
        
        PID:11952
        
        C:\Windows\SysWOW64\Kmbmdeoj.exe
        
        C:\Windows\system32\Kmbmdeoj.exe
        21⤵
        
        PID:19204
        
        C:\Windows\SysWOW64\Kjfmminc.exe
        
        C:\Windows\system32\Kjfmminc.exe
        22⤵
        
        PID:4584
        
        C:\Windows\SysWOW64\Lelajb32.exe
        
        C:\Windows\system32\Lelajb32.exe
        23⤵
        
        PID:14188
  - - C:\Users\Admin\Downloads\240919-qa3jtszgqp_RatAlerts.exe
      C:\Users\Admin\Downloads\240919-qa3jtszgqp_RatAlerts.exe
      4⤵
      PID:10424
  - - C:\Users\Admin\Downloads\240919-qg9xgszeng_Trojan.Win32.SystemBC.pz-ffa800461a3106badbf839286081f9e480a98f3ca00efb160eb2ec71bdc24424N
      C:\Users\Admin\Downloads\240919-qg9xgszeng_Trojan.Win32.SystemBC.pz-ffa800461a3106badbf839286081f9e480a98f3ca00efb160eb2ec71bdc24424N
      4⤵
      PID:9428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4820 -ip 4820
1⤵
PID:3756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3564 -ip 3564
1⤵
PID:5048

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 5128 -ip 5128
1⤵
PID:2108

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1216 -ip 1216
1⤵
PID:5000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4804 -ip 4804
1⤵
PID:7296

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 5872 -ip 5872
1⤵
PID:7312

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 7424 -ip 7424
1⤵
PID:11352

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 6792 -ip 6792
1⤵
PID:13224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 11672 -ip 11672
1⤵
PID:18568

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 7276 -ip 7276
1⤵
PID:18856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 7216 -ip 7216
1⤵
PID:15260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 1864 -ip 1864
1⤵
PID:1852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "EdfaFWME" /sc MINUTE /mo 10 /tr "'C:\Program Files\Google\Chrome\Application\123.0.6312.123\EdfaFWM.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:15252

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "EdfaFWM" /sc ONLOGON /tr "'C:\Program Files\Google\Chrome\Application\123.0.6312.123\EdfaFWM.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1784

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "EdfaFWME" /sc MINUTE /mo 9 /tr "'C:\Program Files\Google\Chrome\Application\123.0.6312.123\EdfaFWM.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:14828

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "rlZOrmnr" /sc MINUTE /mo 12 /tr "'C:\Users\Default User\rlZOrmn.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5280

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\9vvjv.exe

Filesize
98KB

MD5
78b055be22a59a0708853d6b67cb0a2f

SHA1
2552f24edb1d95086bce116b304228fd57eb3949

SHA256
21bd7227c4b173e34b8b9fca4629e0168a099d2c96c3ec4b1222ccd2d85fd109

SHA512
f9e03d7527d17435c9b59437b98e471c2cd8e2666ef4d9f216eb7bb61729059e80b7914b508e8e3941f82807c9f69588fdb449e6124a56ec67e2b80a32915d1f

Download Submit
C:\9vvvd.exe

Filesize
194KB

MD5
1916882dcc86f48a5ede07fae51b7dfe

SHA1
08a44e4457efefc8f3bd1cacc481439518d762e1

SHA256
69c55f56662c1b0357e94ffe82f623556dbbaaa63d413e525193858513aaee37

SHA512
fa98542fa2b10df40b82eb3ac8631a2b268b585ce718ec79ff70fdaa3d0b42139d103fd4a4dea6b6a6150f1315a866231e97c6ede2abe3328fac1edb443f8999

Download Submit
C:\Program Files\WindowsPowerShell\Configuration\Schema\Eahobg32.exe

Filesize
1.7MB

MD5
475d2e67ce84a513bd0a1757becc2018

SHA1
8322b7bc21b0114b453812035ef643cf532bdf6c

SHA256
158c9599f5310708e34c67ba1f72241b28e0b5633dec9e786fd6031a95da6d3d

SHA512
0d2277d90853216485a261380727171aa8d2c530ba0d1ce6372f6971d16c37a3ac22196f1fe5c9a9dedd930aee302edfab3e5e89450a6d038bcc98e0af70aedd

Download Submit
C:\Users\Admin\Admin.exe

Filesize
40KB

MD5
1dba6a7540f5daa2a4e9c41bcc7afb06

SHA1
28df01742b429b1ff59b6b043fe5bfebd3e14015

SHA256
31abea83ec797d246bb2207adbb3c326c1fc46fecf79aa6e03a9295f7a259e9a

SHA512
976265571aefa0e6a958de7156bc89aafd7acfb7ef713155746ba4fd5a58888d1a59bfd7faa0fb8e3a17e02d9ca4a15790daeafb2d8021d450a92ccdf6f510cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\LEIkokoI.bat

Filesize
112B

MD5
bae1095f340720d965898063fede1273

SHA1
455d8a81818a7e82b1490c949b32fa7ff98d5210

SHA256
ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a

SHA512
4e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024

Download Submit
C:\Users\Admin\AppData\Local\Temp\UuU.uUu

Filesize
8B

MD5
7855d15427a72ebf3ff4da22f0690275

SHA1
8e75529c81a5e0d60114fc8f61e2c03688731ac0

SHA256
7afde1b625bd5902eb26b93fc7390e0845dc0ae3a1d7346ccd025483652a0a68

SHA512
0e5789cad0e575833f2fd50efdb7f27d9c3e4fccda2475eb1b9938785b3442781871e2900ca7f1d092856894dbc6c4d8e7e40bf769f8cc8b963fb11cffeee168

Download Submit
C:\Users\Admin\AppData\Local\Temp\WQhHLqNQFx.exe

Filesize
710B

MD5
937ad7b2d373d256e8ab55c3b994a0fe

SHA1
5363d8e06facfb7298b6f9ecb14f5cbd81dc698e

SHA256
1c048ce1b818904ca9aa7336f7c925d9c7506da96a59046b31028d31595236a8

SHA512
8ba6719658304a8dac54e26bbe680a7818d27aa37b1add81e50d9a72dc7c62611fbd48c559a6319bb53a1b0d181b569d26e8292e33a23b2b08d6b9e7b9f41448

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
0280f0cd51d0c3056cc90e6dbb2c2acd

SHA1
a7b344dfc350333635f811a58b30ae31fc7f6951

SHA256
e53d74841a04bd21544ccd505482c60d409f4727e3baf203a616c4631d74682c

SHA512
20fe26c2dbbcce904721b981e0edad4eb77557686e583dbadee99cdf7393ccb6150af27d7aa945a2e0e70340dba4de6b020b684da676b38699e9f1899fd89683

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
3f35124d200a269a85601ff14cfd7aad

SHA1
bbb781dcbc3e78e9c4101a52e38cd3d66c431850

SHA256
80374347343051a23063dfddbf5cb7f6ad4cc7243aa7a3bd21c135d505bd0826

SHA512
e6fceabd598706a7a7b57de5ef6835313b97c289caa410975bb558c60b3e1fdeab328c17b3bcf61a6cec706252f2c13a66e7b7bae18eb87c5925c040389b75c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
58eb9f5ce5289d13a43f79d484dea342

SHA1
a81519609c84facfb3ed645ca16ad15a7b8dd696

SHA256
b5e0b1fe9a0c268b81833aaab3d08a363a6e8a1d7729a31bb9a42568467cecd7

SHA512
292f9dda76114d71636c87a6c09ea8605982b523d8fa508033e7b35d661a50126d6a15388777fecb8ac8a74c7ba9a15c541752e76d58cc52bdf9ab13c8bf3bd6

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
de7464043a986dfe6381708b5d9fa402

SHA1
feb8200dc3bfc5b04e5df5322107684d2a3be062

SHA256
5a8640d2f741b6d72941da360eb4fab87f203d623f6a01e24126ca2e1193e973

SHA512
924541e524da1d8c7bee9b265bb4841705d574ce1e61ba67e76f5f0355e7cbd295b969d8606ba186d0100425c03cc52d14d6c26cccb90ab73726fc410b7ec9d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
b6324f97ec2e681c65b5b75aaefab713

SHA1
2668292427ca2de2c34c222460a61a9481478979

SHA256
bd9baca448deb4c992c87cbfb592e348d0c86fdb5e0a6fa272c43fe08fe60017

SHA512
d60c0c824496892ba8ba8ddd9977c6a59f77d3cb99518e1b0224a4918f3e91b612930eed6ca614c66c4cc5cabd6bcbb976569432c612b1bb153be7ca8ee54e1a

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
a5827d16b91a43cb7475f559b00ec4bc

SHA1
bca1923cb18bde281cc9bd2477c0dcdd090f0091

SHA256
6f5b27f90db6613d8793afb509651279699f01ba426db7e376595df0197cb028

SHA512
151b21601e74f53eef8d86b1df17689e0aaca8483c3ece25f347e3de31366d0b00ad7fd091413e76ed728e37b9d988c713cd2c61baeb69fa573b95182135d6fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
9d919015fa57235061e31d3779224b43

SHA1
56dd0ba2c669333f4bb223e34d2c49076b4de48b

SHA256
66882cd232b3f24bdaf7b23a3a33e3670904eecb36dfdaa843b98468585676dd

SHA512
43ac5f575002078bdf287622491110e4d7b1ed3d3a3eed6bf9d38c93d5e1140840e533549b4fd5135ab59b2b9207759ec5ecc41a05974c53cf95ab7091eb7230

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
b59950aa2758392a94a7adcbb8307784

SHA1
4a6465c6864396fbee6ad5cba8a447cee519ea22

SHA256
651ba9b1fd0d97605569b30411dc26d7c92ee0cd8e14a6c44bcc52f0b3a0e01c

SHA512
a9bcedcae1b5f2f75834abf465249f6d796f0dbe76b27078ab6eb8b36d69157eb84bafd5fb91cf663427be0c9120bdc8d5a40009d9cd27bbb2a4f44932369ac6

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
c37bb8586f5a454d9747dc9d88fc37e0

SHA1
ac9afa799d754a5ce67a5d37e45da0fcc27aba2e

SHA256
3c24797807df1e07079d1ec869c83daf879b82479432013efdf918dd3530461e

SHA512
d34f4c170b29d9cd1a16602fd91b97c68ccd40f0842791ec6215d30cb2712813777bf15b606908a3039e7a43cee78321635ed2042813665c615c691f5e22acc2

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
2a2ebc860da85e200cfdb21953c2c741

SHA1
1289af9e3590b4a718b25b941918885b25b0d905

SHA256
6ed2876600b96594b3e4d9910f1cfba37065b18b8631ef73c152da57990e3db8

SHA512
2f94a71fe71e7700338a91554a9314181b5790facfe2ae8ceb681f268b9fc3266777e943170e0f61166a4eaa08577dfc39c8110700b769add98edd1aa1e74b62

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
1f2d3533a662c31140b637a87f0bbc66

SHA1
87ed32aba10acacc978126b7f5eebeabf11783e8

SHA256
5f37209ab6924b24b4a8f98675089243e9d77c90807c7ee41d77173a3989eb31

SHA512
48fbb490c2952d830b1e7b5d9cc6b23fa163f381cad79d42fd35a17dcdf6d823922f47ae96b79eab2d3bdde0fe3db98a4d2607dc36f97d2eb6a247467b70abce

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
622567b8883a1e7de400ff7463b52064

SHA1
1fdc8f45d550bf8210ea0d0e6512417504286e93

SHA256
3e510498783533bce5dc276312f28835a4e056f2dd9c9f49091e79fccbf7090a

SHA512
34c81ae01adbfba61fb9ddec6fecbf279cabc74a33aa06cc20584246333968c1ca2e44c4c48bb37fb55ab04a5ae26b116e879950f4b7e51cc0c61c98de220617

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
dcd57a955c6d620390deda6504294600

SHA1
5bdd4f952e19b4b670f09bf850748646e9243c91

SHA256
496611be2910f606ebf6d9791bb6a14278d454fccff40815cf17d6ba8bc73cb0

SHA512
88d9605cdfcaf902e3a4460df4d138518ad5769b86994b83fb69872a4cc8ded2fa296d11cbaf4a5d63ab3a31e98c65e8ba36a35d5b02c6bd93b4d856726f25b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
b6a1d4a3af10164d4ee478dd341ed66e

SHA1
6ba95650ec7f12b9f0a2efd7f1c7547ab672c1f0

SHA256
84fb343c4e400a63948e5ac7e584af19a5517b8423ab804e52e54f0e0021919c

SHA512
155e69599a77e2f0c002766d5bcc03014805dba622657dec8f592d307cd6f339fdbd0f67a432e3b02be495f72eb97cd175a8058677414e7d6e75663f9cae1d73

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
7b23f624c604a12160fe6fbd9b391575

SHA1
82ca4d87861275554691fca6c94787e750c814a0

SHA256
bf0faf5773f2e44c1a920f27386a205a68b854a225ac1c3c084c30932f29dfb0

SHA512
dc423d7e576284df266f0eb2b3c0bb5513a17fba758ca2aea1554af3a78327606fa815490ade4877926d1356f7d400a6433adf7012f779e5f131c4c76e7927d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
45afeab5151ac6687a299451cf8167ef

SHA1
7125ce9350244fda52915e0b38dd54f56fdddfa1

SHA256
b01cca37ebc4b5b4a51df8581b00040f1eaa75466c51f97d14fae08240c1764b

SHA512
2faa92b1070dc09b85ac5932c1f2269cd73479bf213b13d331ec812e63dffd151a46f645bd832085b9a09dd8596a8113d0115c3d1b0acd04f7c76dd16b2799f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
ca39babc98213d2d0102657f22ae13bd

SHA1
50a595faa6189edd1f47172b2166b88e8a5ae025

SHA256
ed0f20862a55d4e0151ea311a2e0a1de01aa64ee147eb235390fdce984227f0d

SHA512
f8724bf920689885175f8aa4fd06bd8d9f0ff0d849dd839eb8fdb0625bcfe9f22f779d7565bce809e3b01d13d29508587b4d943024d889f42ed882c68f688bbf

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
db4531218d64218d9e8d1867d96cc30b

SHA1
d351360fc92881c16f3ca0e3234829572ecb95e3

SHA256
bbb3a7faef162d338ed90a14aeaa66d41a0e9898ca9c42f06dc5088a5bc0ec9b

SHA512
87d0b66a94512ec2c20e961ed039dd33458d5b0930c6e936a5c809b3691669837d0e627d4a81c67906ce8d87ff28c3fa05e407476e5778922a3b9c26a62b41c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
4edc164f01fb9615f29704381e8fa098

SHA1
24f6abf0c6269e93f9a4b9eb55f32575ade861ac

SHA256
657640bdf06422737a2efa8ee3b0feb7706d7944b278099ec994c5ba290c4100

SHA512
99e6ca6cedf3eed7a171561d182840ffad9c309ac103758a642066520de8a479e6a54badc98e8540d8f37abfee70a9be89575467172f1e9f6175b0eb057cea60

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
f77bc3874ef43385d1143e7a67766be0

SHA1
b5050c224c10c49b863df10d0938fd72757668dd

SHA256
de3d5e01aebc89c8048b10c0d7028ecfc71cac9ec95111f2ccf0113ae2fcf04f

SHA512
062db21c9b2eacf0f79260d5aa6c09a21cf6817a161114e52b5fc761a63c4df2cf98d365d2789146f09a7f74d459836da4f75bae2caa754088df63e6d112aaf0

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
26fc96a31a929e9f1af7f1933912a073

SHA1
5f7471ac5e7050eebbf876df2ac3c7a2d7943a9d

SHA256
05941bdf2cbdd3e90071e181bb1c129c16d494ad07df4c4b3ecb6a3557caf53b

SHA512
0830c0840106c79db3415e9b92a9370cfae34bea03de053fe6abf0ab4afad104a78cbb954cf5d126890f140e0aaf75ef15c6131512f1b8327cec10e7b590389a

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
e315e6b7ae091ca7fc05d0d60685ce93

SHA1
f079256881cf6c8e8e3f56f4e4996f09deb9d5bb

SHA256
ab215ac2a7dd68bba48329d033ec56170e79751fd12c0fd064663fe9866047f5

SHA512
e91a0319de3912e210d93f87823f8ff99283506be55274ac128d3268caa8f198939a02d14803c9e58166acd374406d4e69d69a3262dcd339828a61a6861c3b68

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
96a499cc621ff8533a16ed3f0986adfa

SHA1
ceda1be5aa1d29a38548f8aca96ef645cb0ccfbe

SHA256
f4fcc3062f63c51c874a5bbd179d20c44f8f582a0b5ddc28fe24a17ab95b5419

SHA512
a1127d09fa97079acb28c3716ced2ee808362061c77715293696ad708153f14ae2f75c9124b1aa33c0680b8002994caeaf2d0bef13d4958f6181df1a74a44371

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
1307fad9d19e26146eab215f073d2ce4

SHA1
2f23d9b79474599a49f3a70980cab788f322089c

SHA256
51ad97aad2c1e583de5adde53fc1b0b11c61a34a65c77c603d70b84a098b2e93

SHA512
06b633c44743354fd232aeb8c5725ca26f134578f0d0d0904951d89e2797a1e83cbda1d21e7c15730ad9485960e483ca79001689b5c94535b8e5538acdae748f

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
062a90d8a5e9b36c501cc070d2637d8b

SHA1
35ed5e34a189e690d96b163d644b8a5662ef2698

SHA256
971f8fbb928e211fba7d12421119c566681f9f4fbeec89ed803c218c3b808ea7

SHA512
dacd4f9caf15266f58b1b5fd39b041e7bd96de76adf97832c792bdaac85899d9f70e9a59b61d2e76d33eca5639875e3d06e225217d21c7bbb4346d6ddaf0f3e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
145bf9982856f6d8dc612260e9eada80

SHA1
0767c6444d47dbe2432bb44005c9bc1201adbb98

SHA256
ecf37ca79b78d434a04ce13c67f11dd802ed6b8dffef2a0d0fc878a7063bcf48

SHA512
aec065d2a5e1cc1651182013106309417f44eb255b32d64c9cb1b294aa0ed7103e7eaecbe251e2461415f54f09fec178b2f4734682c268d8eca544011b07582c

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
431a633ec4c9bfdc0ba4c5600ed23a5d

SHA1
b53f2450cf9917b8913c865fd409f080da89fb0b

SHA256
84dcca00a74ea3325d809232eb43e39834381cb7725764ee5579d20535247736

SHA512
dc880535b358d3648fbaa4d681c2364f3be06514249ec2d84f99769e104dce15b172fc17758fbd4c6047963df30590cb491a9fc4f43aca54f5e675da6bf636c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
cecfca6b5e7a9dc1e17934e390497a8b

SHA1
bf89bd24fab4071b2b0245f98b29e8ff03afefab

SHA256
5027cb253c73922619d33271bd1cafcfa38fe06417e1252c29a5584f6581c93e

SHA512
af2567ee41a4276e7378d0310fc271b3329e71ba5fee553a547d28fd3d08b3668d36fac7a7cc52b7a882d5732b625110e72c9a07db0858dff693c1995fd6ce86

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
9fbc8e9d5de9916a1e347d66cf828be6

SHA1
821141b58f7b617f4e81ef49fddfad33bdcecc83

SHA256
b814f33095ec4783c390b7090b1d845c2da8079b5539d4f2617cf507154e084c

SHA512
8e4107cb3f8f7e0a0d367d7b010a13cec99cc0edea76cbc89333ddded1238136bf15903cf20925bede42db408840e34dd243c6ffff264333dbaed437ac8217e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
f12a21c0f1c576ee6c6b8d5f53e8c60c

SHA1
82375e33ad0ef9828f2227c83f8a3d5fbc53d102

SHA256
c913c595caa6154d902c8905c14ce0d71278d536fcf51ceb8b6c02120b1cd06d

SHA512
2dc313422c575c464454c8914fc46a70a32c2da3279c292e4f71580e5997acd4949bfd5d02291936bfda6a98451a05959b635ed758a74a19f38c612db77482b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11442\VCRUNTIME140.dll

Filesize
96KB

MD5
f12681a472b9dd04a812e16096514974

SHA1
6fd102eb3e0b0e6eef08118d71f28702d1a9067c

SHA256
d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8

SHA512
7d3accbf84de73fb0c5c0de812a9ed600d39cd7ed0f99527ca86a57ce63f48765a370e913e3a46ffc2ccd48ee07d823dafdd157710eef9e7cc1eb7505dc323a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11442\VCRUNTIME140_1.dll

Filesize
37KB

MD5
75e78e4bf561031d39f86143753400ff

SHA1
324c2a99e39f8992459495182677e91656a05206

SHA256
1758085a61527b427c4380f0c976d29a8bee889f2ac480c356a3f166433bf70e

SHA512
ce4daf46bce44a89d21308c63e2de8b757a23be2630360209c4a25eb13f1f66a04fbb0a124761a33bbf34496f2f2a02b8df159b4b62f1b6241e1dbfb0e5d9756

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11442\_asyncio.pyd

Filesize
62KB

MD5
2859c39887921dad2ff41feda44fe174

SHA1
fae62faf96223ce7a3e6f7389a9b14b890c24789

SHA256
aebc378db08617ea81a0a3a3bc044bcc7e6303e314630392dd51bab12f879bd9

SHA512
790be0c95c81eb6d410e53fe8018e2ca5efd1838dc60539ebb011911c36c8478333ee95989cfd1ddaf4f892b537ae8305eb4cd893906930deae59c8965cf2fbb

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11442\_bz2.pyd

Filesize
81KB

MD5
4101128e19134a4733028cfaafc2f3bb

SHA1
66c18b0406201c3cfbba6e239ab9ee3dbb3be07d

SHA256
5843872d5e2b08f138a71fe9ba94813afee59c8b48166d4a8eb0f606107a7e80

SHA512
4f2fc415026d7fd71c5018bc2ffdf37a5b835a417b9e5017261849e36d65375715bae148ce8f9649f9d807a63ac09d0fb270e4abae83dfa371d129953a5422ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11442\_cffi_backend.cp311-win_amd64.pyd

Filesize
174KB

MD5
739d352bd982ed3957d376a9237c9248

SHA1
961cf42f0c1bb9d29d2f1985f68250de9d83894d

SHA256
9aee90cf7980c8ff694bb3ffe06c71f87eb6a613033f73e3174a732648d39980

SHA512
585a5143519ed9b38bb53f912cea60c87f7ce8ba159a1011cf666f390c2e3cc149e0ac601b008e039a0a78eaf876d7a3f64fff612f5de04c822c6e214bc2efde

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11442\_ctypes.pyd

Filesize
120KB

MD5
6a9ca97c039d9bbb7abf40b53c851198

SHA1
01bcbd134a76ccd4f3badb5f4056abedcff60734

SHA256
e662d2b35bb48c5f3432bde79c0d20313238af800968ba0faa6ea7e7e5ef4535

SHA512
dedf7f98afc0a94a248f12e4c4ca01b412da45b926da3f9c4cbc1d2cbb98c8899f43f5884b1bf1f0b941edaeef65612ea17438e67745962ff13761300910960d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11442\_decimal.pyd

Filesize
245KB

MD5
d47e6acf09ead5774d5b471ab3ab96ff

SHA1
64ce9b5d5f07395935df95d4a0f06760319224a2

SHA256
d0df57988a74acd50b2d261e8b5f2c25da7b940ec2aafbee444c277552421e6e

SHA512
52e132ce94f21fa253fed4cf1f67e8d4423d8c30224f961296ee9f64e2c9f4f7064d4c8405cd3bb67d3cf880fe4c21ab202fa8cf677e3b4dad1be6929dbda4e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11442\_hashlib.pyd

Filesize
62KB

MD5
de4d104ea13b70c093b07219d2eff6cb

SHA1
83daf591c049f977879e5114c5fea9bbbfa0ad7b

SHA256
39bc615842a176db72d4e0558f3cdcae23ab0623ad132f815d21dcfbfd4b110e

SHA512
567f703c2e45f13c6107d767597dba762dc5caa86024c87e7b28df2d6c77cd06d3f1f97eed45e6ef127d5346679fea89ac4dc2c453ce366b6233c0fa68d82692

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11442\_lzma.pyd

Filesize
154KB

MD5
337b0e65a856568778e25660f77bc80a

SHA1
4d9e921feaee5fa70181eba99054ffa7b6c9bb3f

SHA256
613de58e4a9a80eff8f8bc45c350a6eaebf89f85ffd2d7e3b0b266bf0888a60a

SHA512
19e6da02d9d25ccef06c843b9f429e6b598667270631febe99a0d12fc12d5da4fb242973a8351d3bf169f60d2e17fe821ad692038c793ce69dfb66a42211398e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11442\_multiprocessing.pyd

Filesize
32KB

MD5
1386dbc6dcc5e0be6fef05722ae572ec

SHA1
470f2715fafd5cafa79e8f3b0a5434a6da78a1ba

SHA256
0ae3bf383ff998886f97576c55d6bf0a076c24395cf6fcd2265316e9a6e8c007

SHA512
ca6e5c33273f460c951cb8ec1d74ce61c0025e2ead6d517c18a6b0365341a0fd334e8976006cd62b72eb5620ccc42cfdd5196e8b10691b8f19f69f851a440293

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11442\_overlapped.pyd

Filesize
48KB

MD5
01ad7ca8bc27f92355fd2895fc474157

SHA1
15948cd5a601907ff773d0b48e493adf0d38a1a6

SHA256
a083e83f609ed7a2fc18a95d44d8f91c9dc74842f33e19e91988e84db94c3b5b

SHA512
8fe6ac8430f8dde45c74f45575365753042642dc9fa9defbcf25ae1832baf6abb1ea1ad6d087e4ece5d0590e36cee1beea99845aef6182c1eec4bafdf9557604

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11442\_queue.pyd

Filesize
30KB

MD5
ff8300999335c939fcce94f2e7f039c0

SHA1
4ff3a7a9d9ca005b5659b55d8cd064d2eb708b1a

SHA256
2f71046891ba279b00b70eb031fe90b379dbe84559cf49ce5d1297ea6bf47a78

SHA512
f29b1fd6f52130d69c8bd21a72a71841bf67d54b216febcd4e526e81b499b9b48831bb7cdff0bff6878aab542ca05d6326b8a293f2fb4dd95058461c0fd14017

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11442\_socket.pyd

Filesize
76KB

MD5
8140bdc5803a4893509f0e39b67158ce

SHA1
653cc1c82ba6240b0186623724aec3287e9bc232

SHA256
39715ef8d043354f0ab15f62878530a38518fb6192bc48da6a098498e8d35769

SHA512
d0878fee92e555b15e9f01ce39cfdc3d6122b41ce00ec3a4a7f0f661619f83ec520dca41e35a1e15650fb34ad238974fe8019577c42ca460dde76e3891b0e826

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11442\_ssl.pyd

Filesize
155KB

MD5
069bccc9f31f57616e88c92650589bdd

SHA1
050fc5ccd92af4fbb3047be40202d062f9958e57

SHA256
cb42e8598e3fa53eeebf63f2af1730b9ec64614bda276ab2cd1f1c196b3d7e32

SHA512
0e5513fbe42987c658dba13da737c547ff0b8006aecf538c2f5cf731c54de83e26889be62e5c8a10d2c91d5ada4d64015b640dab13130039a5a8a5ab33a723dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11442\_tcl_data\encoding\cp1252.enc

Filesize
1KB

MD5
e9117326c06fee02c478027cb625c7d8

SHA1
2ed4092d573289925a5b71625cf43cc82b901daf

SHA256
741859cf238c3a63bbb20ec6ed51e46451372bb221cfff438297d261d0561c2e

SHA512
d0a39bc41adc32f2f20b1a0ebad33bf48dfa6ed5cc1d8f92700cdd431db6c794c09d9f08bb5709b394acf54116c3a1e060e2abcc6b503e1501f8364d3eebcd52

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11442\_tkinter.pyd

Filesize
61KB

MD5
442304ce4ad2d40e0d85a89b52b6d272

SHA1
5b5add527dd6fea47d4caa923694eee8d741b488

SHA256
6ff6cc788f1ab19de383810ddbd15ecd5fc8216faf5e1e406bbf9a608fbb9991

SHA512
df5a47780a6642c310417c2d2e8c439eb2a324d9318ef1ea5af36c5657cc34a8aa950edbe5f91869bf0d50cccebcb7a08447dbcfdc75e29acc8c72327f231e43

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11442\base_library.zip

Filesize
1.4MB

MD5
481da210e644d6b317cafb5ddf09e1a5

SHA1
00fe8e1656e065d5cf897986c12ffb683f3a2422

SHA256
3242ea7a6c4c712f10108a619bf5213878146547838f7e2c1e80d2778eb0aaa0

SHA512
74d177794f0d7e67f64a4f0c9da4c3fd25a4d90eb909e942e42e5651cc1930b8a99eef6d40107aa8756e75ffbcc93284b916862e24262df897aaac97c5072210

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11442\certifi\cacert.pem

Filesize
292KB

MD5
50ea156b773e8803f6c1fe712f746cba

SHA1
2c68212e96605210eddf740291862bdf59398aef

SHA256
94edeb66e91774fcae93a05650914e29096259a5c7e871a1f65d461ab5201b47

SHA512
01ed2e7177a99e6cb3fbef815321b6fa036ad14a3f93499f2cb5b0dae5b713fd2e6955aa05f6bda11d80e9e0275040005e5b7d616959b28efc62abb43a3238f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11442\charset_normalizer\md.cp311-win_amd64.pyd

Filesize
10KB

MD5
723ec2e1404ae1047c3ef860b9840c29

SHA1
8fc869b92863fb6d2758019dd01edbef2a9a100a

SHA256
790a11aa270523c2efa6021ce4f994c3c5a67e8eaaaf02074d5308420b68bd94

SHA512
2e323ae5b816adde7aaa14398f1fdb3efe15a19df3735a604a7db6cadc22b753046eab242e0f1fbcd3310a8fbb59ff49865827d242baf21f44fd994c3ac9a878

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11442\charset_normalizer\md__mypyc.cp311-win_amd64.pyd

Filesize
116KB

MD5
9ea8098d31adb0f9d928759bdca39819

SHA1
e309c85c1c8e6ce049eea1f39bee654b9f98d7c5

SHA256
3d9893aa79efd13d81fcd614e9ef5fb6aad90569beeded5112de5ed5ac3cf753

SHA512
86af770f61c94dfbf074bcc4b11932bba2511caa83c223780112bda4ffb7986270dc2649d4d3ea78614dbce6f7468c8983a34966fc3f2de53055ac6b5059a707

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11442\libcrypto-1_1.dll

Filesize
3.3MB

MD5
6f4b8eb45a965372156086201207c81f

SHA1
8278f9539463f0a45009287f0516098cb7a15406

SHA256
976ce72efd0a8aeeb6e21ad441aa9138434314ea07f777432205947cdb149541

SHA512
2c5c54842aba9c82fb9e7594ae9e264ac3cbdc2cc1cd22263e9d77479b93636799d0f28235ac79937070e40b04a097c3ea3b7e0cd4376a95ed8ca90245b7891f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11442\libffi-8.dll

Filesize
34KB

MD5
32d36d2b0719db2b739af803c5e1c2f5

SHA1
023c4f1159a2a05420f68daf939b9ac2b04ab082

SHA256
128a583e821e52b595eb4b3dda17697d3ca456ee72945f7ecce48ededad0e93c

SHA512
a0a68cfc2f96cb1afd29db185c940e9838b6d097d2591b0a2e66830dd500e8b9538d170125a00ee8c22b8251181b73518b73de94beeedd421d3e888564a111c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11442\libssl-1_1.dll

Filesize
686KB

MD5
8769adafca3a6fc6ef26f01fd31afa84

SHA1
38baef74bdd2e941ccd321f91bfd49dacc6a3cb6

SHA256
2aebb73530d21a2273692a5a3d57235b770daf1c35f60c74e01754a5dac05071

SHA512
fac22f1a2ffbfb4789bdeed476c8daf42547d40efe3e11b41fadbc4445bb7ca77675a31b5337df55fdeb4d2739e0fb2cbcac2feabfd4cd48201f8ae50a9bd90b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11442\numpy\core\_multiarray_umath.cp311-win_amd64.pyd

Filesize
2.7MB

MD5
ea2e696dd221290a44fc7f095c4f185b

SHA1
dd5ae42ae6d2678d65b003ba4ca8286a80586869

SHA256
c76d812fa5131fe21c8bf9ffbd910f27df80856f910fa61698f23f60cfd9d13e

SHA512
7a811681652fb53d2da2ec0042b73a6b75b95defc9b47422df0148832a71079832a10d45ac6e457d26a708a30544ad45f08a87e61426c1f3c8252e48c6374b27

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11442\pyexpat.pyd

Filesize
193KB

MD5
1c0a578249b658f5dcd4b539eea9a329

SHA1
efe6fa11a09dedac8964735f87877ba477bec341

SHA256
d97f3e27130c267e7d3287d1b159f65559e84ead9090d02a01b4c7dc663cd509

SHA512
7b21dcd7b64eeba13ba8a618960190d1a272fa4805dedcf8f9e1168aebfe890b0ced991435ecbd353467a046fc0e8307f9a9be1021742d7d93aa124c52cc49e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11442\python3.DLL

Filesize
64KB

MD5
34e49bb1dfddf6037f0001d9aefe7d61

SHA1
a25a39dca11cdc195c9ecd49e95657a3e4fe3215

SHA256
4055d1b9e553b78c244143ab6b48151604003b39a9bf54879dee9175455c1281

SHA512
edb715654baaf499cf788bcacd5657adcf9f20b37b02671abe71bda334629344415ed3a7e95cb51164e66a7aa3ed4bf84acb05649ccd55e3f64036f3178b7856

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11442\python311.dll

Filesize
5.5MB

MD5
9a24c8c35e4ac4b1597124c1dcbebe0f

SHA1
f59782a4923a30118b97e01a7f8db69b92d8382a

SHA256
a0cf640e756875c25c12b4a38ba5f2772e8e512036e2ac59eb8567bf05ffbfb7

SHA512
9d9336bf1f0d3bc9ce4a636a5f4e52c5f9487f51f00614fc4a34854a315ce7ea8be328153812dbd67c45c75001818fa63317eba15a6c9a024fa9f2cab163165b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11442\pywin32_system32\pythoncom311.dll

Filesize
654KB

MD5
f98264f2dacfc8e299391ed1180ab493

SHA1
849551b6d9142bf983e816fef4c05e639d2c1018

SHA256
0fe49ec1143a0efe168809c9d48fe3e857e2ac39b19db3fd8718c56a4056696b

SHA512
6bb3dbd9f4d3e6b7bd294f3cb8b2ef4c29b9eff85c0cfd5e2d2465be909014a7b2ecd3dc06265b1b58196892bb04d3e6b0aa4b2ccbf3a716e0ff950eb28db11c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11442\pywin32_system32\pywintypes311.dll

Filesize
131KB

MD5
90b786dc6795d8ad0870e290349b5b52

SHA1
592c54e67cf5d2d884339e7a8d7a21e003e6482f

SHA256
89f2a5c6be1e70b3d895318fdd618506b8c0e9a63b6a1a4055dff4abdc89f18a

SHA512
c6e1dbf25d260c723a26c88ec027d40d47f5e28fc9eb2dbc72a88813a1d05c7f75616b31836b68b87df45c65eef6f3eaed2a9f9767f9e2f12c45f672c2116e72

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11442\select.pyd

Filesize
28KB

MD5
97ee623f1217a7b4b7de5769b7b665d6

SHA1
95b918f3f4c057fb9c878c8cc5e502c0bd9e54c0

SHA256
0046eb32f873cde62cf29af02687b1dd43154e9fd10e0aa3d8353d3debb38790

SHA512
20edc7eae5c0709af5c792f04a8a633d416da5a38fc69bd0409afe40b7fb1afa526de6fe25d8543ece9ea44fd6baa04a9d316ac71212ae9638bdef768e661e0f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11442\tcl86t.dll

Filesize
1.8MB

MD5
ac6cd2fb2cd91780db186b8d6e447b7c

SHA1
b387b9b6ca5f0a2b70028ab2147789c4fe24ef7a

SHA256
a91781fe13548b89817462b00058a75fb0b607ec8ce99d265719ced573ade7b6

SHA512
45b24ca07a44d8d90e5efeded2697a37f000b39d305fe63a67292fdd237de3f8efd5e85b139b5702faa695f9f27f12f24ac497e005e2f3c24c141d7cd85305b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11442\tk86t.dll

Filesize
1.5MB

MD5
499fa3dea045af56ee5356c0ce7d6ce2

SHA1
0444b7d4ecd25491245824c17b84916ee5b39f74

SHA256
20139f4c327711baf18289584fa0c8112f7bb3ba55475bded21f3d107672ed94

SHA512
d776749effa241ba1415b28d2fcff1d64ed903569a8c4e56dfddd672a53b2f44119734b1959b72a9b3f4060bb2c67b7dea959cc2d4a8e9f781f17009c6840fc1

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11442\unicodedata.pyd

Filesize
1.1MB

MD5
bc58eb17a9c2e48e97a12174818d969d

SHA1
11949ebc05d24ab39d86193b6b6fcff3e4733cfd

SHA256
ecf7836aa0d36b5880eb6f799ec402b1f2e999f78bfff6fb9a942d1d8d0b9baa

SHA512
4aa2b2ce3eb47503b48f6a888162a527834a6c04d3b49c562983b4d5aad9b7363d57aef2e17fe6412b89a9a3b37fb62a4ade4afc90016e2759638a17b1deae6c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11442\win32\win32api.pyd

Filesize
130KB

MD5
1d6762b494dc9e60ca95f7238ae1fb14

SHA1
aa0397d96a0ed41b2f03352049dafe040d59ad5d

SHA256
fae5323e2119a8f678055f4244177b5806c7b6b171b1945168f685631b913664

SHA512
0b561f651161a34c37ff8d115f154c52202f573d049681f8cdd7bba2e966bb8203780c19ba824b4a693ef12ef1eeef6aeeef96eb369e4b6129f1deb6b26aaa00

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI11442\zstandard\backend_c.cp311-win_amd64.pyd

Filesize
512KB

MD5
dc08f04c9e03452764b4e228fc38c60b

SHA1
317bcc3f9c81e2fc81c86d5a24c59269a77e3824

SHA256
b990efbda8a50c49cd7fde5894f3c8f3715cb850f8cc4c10bc03fd92e310260f

SHA512
fbc24dd36af658cece54be14c1118af5fda4e7c5b99d22f99690a1fd625cc0e8aa41fd9accd1c74bb4b03d494b6c3571b24f2ee423aaae9a5ad50adc583c52f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\askut.exe

Filesize
328KB

MD5
cfbf6497ace3fea9f3773360dad46fdf

SHA1
2a3d2ca80c00962a42d6cfa86fc28163b1f5f0f6

SHA256
fabf0deea9438828e145909d3d86ac4d5341d0c955f00e44c5ebb81c121fb2eb

SHA512
3ca06e90227d67b41a453558d5d4ad5f27db65922f44f2b206382acde5fdd098219711d0ea4634791b770ac60427ce4ca5991a3d038ebbd6cc29460c0a5ebbac

Download Submit
C:\Users\Admin\AppData\Local\Temp\file.vbs

Filesize
19B

MD5
4afb5c4527091738faf9cd4addf9d34e

SHA1
170ba9d866894c1b109b62649b1893eb90350459

SHA256
59d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc

SHA512
16d386d9ece30b459fd47ca87da1f67b38d52a8e55f8fd063762cb3b46ae2c10bc6eac7359b0d1ef4c31c1ac8748ae8f62f8816eff0691abdd3304df38e979a5

Download Submit
C:\Users\Admin\AppData\Roaming\BF54B\B5C6.F54

Filesize
1KB

MD5
a3d6e2bd6ce9648e786f1c3959785b6b

SHA1
52ef838274d2771907ecbe4acd10fc25c13b6e0b

SHA256
2ec1aaf06441c737f4f7477a1dbedfae9c09f020d73d77c2aa8786d386e3a92f

SHA512
e59143e79d2d015e9413d2ca36a330ce2cca0aa5045667536da82e948f92b21b59c17f57b3147dc98d23176416230f0cc1117cfc9e8880902f45f359791459c3

Download Submit
C:\Users\Admin\AppData\Roaming\BF54B\B5C6.F54

Filesize
600B

MD5
1259a1df8ac459a92e8684ee0af94dc7

SHA1
7812d03871630980db244bae126afc84c76d6e82

SHA256
6aeb9d3f2170364347ddb96561f18bf555755a0047611272831f526f0e19f51f

SHA512
3103fdded538176cfdf60c4bf7b261cf3352952061ccfe729ae296c886bf71340cbef8e7f603b019749b50d20150f2bea985392acfcba605a98230fb59ac391c

Download Submit
C:\Users\Admin\AppData\Roaming\hostsys.exe

Filesize
67KB

MD5
eb6a6d7569cdeac7cc12223dda7b73f9

SHA1
d5586aae8ea3065e6cf67b7faafd931d378794b0

SHA256
349504e02333bed5c8829386064969102c7fc288e372bb8cd525a7ad09de9f90

SHA512
dc8b410c0d549f71b631adb1164fe1428c6ba906a8b613f2cd514ac94eaeadffb323d9fef65b2e44868995a4c8bf114e670e227afea9ed3ad6d7cfa9fa06a029

Download Submit
C:\Users\Admin\AppData\Roaming\logs.dat

Filesize
15B

MD5
bf3dba41023802cf6d3f8c5fd683a0c7

SHA1
466530987a347b68ef28faad238d7b50db8656a5

SHA256
4a8e75390856bf822f492f7f605ca0c21f1905172f6d3ef610162533c140507d

SHA512
fec60f447dcc90753d693014135e24814f6e8294f6c0f436bc59d892b24e91552108dba6cf5a6fa7c0421f6d290d1bafee9f9f2d95ea8c4c05c2ad0f7c1bb314

Download Submit
C:\Users\Admin\Downloads\240919-qc1g9azhnr_caa0243b19b465fa159ddb6672a825b1cc649cff20334ae38eac6f8c9f4198d4.exe

Filesize
2.3MB

MD5
ba85ec441b01fc3fba98363ef5c4da90

SHA1
ca2ac143122c67da7260aa1a427f109ea8a8b0df

SHA256
caa0243b19b465fa159ddb6672a825b1cc649cff20334ae38eac6f8c9f4198d4

SHA512
08a5827c84fb672b0cd3354328e9be66838ce59c8f66034e3e0b38523adc44e8659bfd0f8e1848b8eb66497496628ae3d0396b99e3b44cdf0e002d57b00286fd

Download Submit
C:\Users\Admin\Downloads\240919-qjdbaszerg_2d1462a662bcfd7e722f72fdc4ffefe5f8a82e53ab40ac2ea83c7b7b46a7d0efN.exe

Filesize
1.8MB

MD5
b83368e4e49fa5afc2546b625ef2fbc0

SHA1
42245fa5861a84a60ed5b738ae47adf214866de1

SHA256
2d1462a662bcfd7e722f72fdc4ffefe5f8a82e53ab40ac2ea83c7b7b46a7d0ef

SHA512
ff3984d90ef469c6e4c7e6f6702692148f170d40d677af815af02fcb5a2559285334a88a051e214fa2b989c0c2e7803fd4332a52aecf9111845c547521933bba

Download Submit
C:\Users\Admin\Downloads\240919-qnt5ls1drp_c9babc7ce04e1bab2cf1a7c5f4a6719fe6a2f1921f22eacfe3075bef1ff8b511N.exe

Filesize
1.7MB

MD5
cbb2749fd8d62dbf77e4f48eb9fb2c40

SHA1
7f4425c141cb556e0297cd0b47033df7e2f29e3c

SHA256
c9babc7ce04e1bab2cf1a7c5f4a6719fe6a2f1921f22eacfe3075bef1ff8b511

SHA512
5db8498b04f57524057d2f842eebb0bd2ac8d4c7b642abc970461048fe589d98c8ac2f3f0cb11442da0067b680baa875497a90cbe33f127b188771f028070519

Download Submit
C:\Users\Admin\Downloads\240919-qnzp4azgra_Worm.Win32.Mydoom.pz5851085fd7c81bbd629d3145500cbbea1d499b80a044b5f1f2a736f66d0dd69bN

Filesize
41KB

MD5
b732c35773157dad9d09506d47577340

SHA1
76d64fff0f59b1bbcdba891fc4cf1dd851c462c0

SHA256
5851085fd7c81bbd629d3145500cbbea1d499b80a044b5f1f2a736f66d0dd69b

SHA512
b5600594bc4d012fa802d4e49d37da496a67c7c0193658031b65e3fdc72724fda6c86068a62f82bd063ee04fc812a9cf9cd5a550bf4cd72a761b33ce73d28940

Download Submit
C:\Users\Admin\Downloads\240919-qqj3es1epm_2024-09-19_630553d0f28fc3fe152da4891d1e44fd_virlock

Filesize
3KB

MD5
f914e6e58fabc9e45dce8645ff188bde

SHA1
e16ba069be4ac338fbfb731d5dca60685300ffdb

SHA256
51d110882b29e686326a7f942b829e9d1df5c0deb804b59f4e62bab84cdac26b

SHA512
2f3924f255c453ee32bdbced2ca690ef6ed2ef1b09dfb4922bc8db48071c174d7217916109c63ff1a38b09714b5d5f3557dd6aae8edc99e775bf3fefa7d046b7

Download Submit
C:\Users\Admin\Downloads\temp.zip

Filesize
22B

MD5
76cdb2bad9582d23c1f6f4d868218d6c

SHA1
b04f3ee8f5e43fa3b162981b50bb72fe1acabb33

SHA256
8739c76e681f900923b900c9df0ef75cf421d39cabb54650c4b9ad19b6a76d85

SHA512
5e2f959f36b66df0580a94f384c5fc1ceeec4b2a3925f062d7b68f21758b86581ac2adcfdde73a171a28496e758ef1b23ca4951c05455cdae9357cc3b5a5825f

Download Submit
C:\Users\Admin\Downloads\temp.zip

Filesize
180B

MD5
bd6de9ebaef6f36731f19ac6cc554822

SHA1
f78b22482c7d767e1741154bc189f43b2d1df2a3

SHA256
5708530277ed49f722972f0bab99d2faefecdd3e1048102ebe5eaaf65e00620d

SHA512
b478207278dfde8cc7538b1f214f2c8cebf9d8edffdba2a689f4f614882273f544cf36b4c91abc17f7ed469fb2c02898ea65f416c37fb91561fdc7232f0755b1

Download Submit
C:\Users\Admin\Downloads\temp.zip

Filesize
228KB

MD5
f3aaf9844b740b90c90f17421287c5a3

SHA1
e61251ebc9d15f6a02e2136fdc62d6ab21057a31

SHA256
88038ecf68fe22c19e4fb815aa9d4d1607db8e96eacbeb4da59d672d5e647f0f

SHA512
8eff8057e1948e1fc043f5d21f6bd053cf54241591d1e7e343d1228832c442fa85470fe63e11cd95770f453846d6983e6287fa0d374a401b9f438a08fa033a82

Download Submit
C:\Users\Admin\kiuuy.exe

Filesize
204KB

MD5
13d31e84b62047c65c004bb84ecb3a1c

SHA1
36e8aae90a07bcc0129f5f63e3211e358d4e3385

SHA256
c4f8f8926b1a2cbdddb0d8031b13978e0f52631d1361b193d80a3d3d2d9dd854

SHA512
c52f6f80ed7bcc3669dd04cd7a232a770de54ff0ac58aaab718ef8249c71c3dd241f60af6fecaa43002b6657058b705a0d670c3a89687327c53bb127602e6987

Download Submit
C:\Users\Admin\luiyu.exe

Filesize
116KB

MD5
347637a4cb03b86fa081133f62721d84

SHA1
8f6561002bbb788313e08d5a5516f16c0557e0a5

SHA256
3ef47f5387417f7da7d24bc1686c6ae495264fa900ba3dd4863ad7ffad714223

SHA512
416570a8c453bf2bdfcdf95c7f1f0e56be3ae80dbf6a4938016c8865672731e00dacab5f476abfb34783ae28bc38140e92835231b34d80169714baffc02c1e86

Download Submit
C:\Users\Admin\qoiusen.exe

Filesize
240KB

MD5
d06af9b8d4df063fd0a413052d19f7e6

SHA1
5b12ed429fe91897e4a6fb7b75ad30463b88af4e

SHA256
5441f888f5c0a425101a0d27eddbb23baa1e6e407d085cd98f2c54e7133e4915

SHA512
0b5be4e3ec131e0853ae84f06e3758dec5d6fa9b4e38d8648a2d42b0813c0af92d5098374a2b73ea1593e86b85bdfdfe2cab16cee98172bedae81f576a24253d

Download Submit
C:\Windows\SysWOW64\CKM.exe

Filesize
244KB

MD5
3d940db5a36c4850146a7515f36bf64e

SHA1
77e61d2cddbfe4722f623197856a8053a9d6ca73

SHA256
ba471b072fc8d13d946754e6cacc41c2c992581018bff3d051d4a07b5b2bc375

SHA512
ab629b4436dcec4e65899bb9c66263a0d74a48be6ced4a5fd472b20959e858bc69772a1f74b5b20c06ec4860ff03d01bb20074d2c79b567b60480c80c1648d83

Download Submit
C:\Windows\SysWOW64\Dahfkimd.exe

Filesize
96KB

MD5
ce4ab22059ae1bf9502c15d6b5355437

SHA1
7aca949d3e4d2ebd96b4f65645da85468530f48b

SHA256
c3d3db490ef76620ed744936fe66eddf98e93de57c2df01f428641029a1e0ce3

SHA512
e7bedf8c9043364ea5265431f6ecbd4cd5d47dbb7397197d28f30f7d4ea942dd32c74c9077051c0479d52ad59e7887fbbc14c99d65fe9748b438aae89ff7cd9b

Download Submit
C:\Windows\SysWOW64\Ddnobj32.exe

Filesize
62KB

MD5
c85a4656949cdf633fa0ec0ecc43f7f7

SHA1
6a69c8740a8ce8bcf22e10227050bb080f96a41b

SHA256
b12a55c97806f12ffe399c932d0a225653167266bd1507281f6fabaaba2539e7

SHA512
a68a3c4c207fd8796857232501d97745f6064b69c27715a17e1aca51dc9f62f93f09b056003f5dfc7e4d695d06530c728447233aaf9a7984e6e15446aa1d6218

Download Submit
C:\Windows\SysWOW64\Ecfhji32.exe

Filesize
91KB

MD5
be348bc07a72517b268209fc08c9ebc7

SHA1
71185229d6cbbf5570b65305f7a959e56cad3d98

SHA256
c6a1bf7087d54819204fef1005bc4c57b584fed9b2d493cf2cb4e4c8e205a491

SHA512
f13d55769f508770248126c9bd1d03ad764953345a779afa256868966598e267b8e86714ce90be532aea4ff0a3a89d8dcb24e83ad135e75e278deb9da2a924b2

Download Submit
C:\Windows\SysWOW64\Eoongbjn.dll

Filesize
6KB

MD5
5018f40deed4f6e0e0dca01751219cf0

SHA1
374e3af71104655817e65a85384a8c8b8b82ad6c

SHA256
a18b0ebc4af967604782e35cc2f222974fd207e5151cbd57833fad456829bd6d

SHA512
143c8edfad1a7dd8d618ef7d8ea76f23f95ca883640d7190b2b246d0713e0c4c92b2d17697da490f16554bfe9103b2fdea774c1059c8f9bf7ff6740425493f3a

Download Submit
C:\Windows\SysWOW64\Epaemojk.exe

Filesize
264KB

MD5
2c9f9c9b83565fe2c488cc75c4f0ce75

SHA1
771e2b36cff2c94f48465a7518032672eba22884

SHA256
556814ca163297cd4e1e5592931b6667ee671444a15014e05791c84e22e3a17b

SHA512
8c57686507ae8343bd97bd02fb001cb088b199969608bf0eaf9a4e9498a3f707e5f73b46bc97798722641b2a282e5d8856865ea9fbda1ca25eeb5b413893e640

Download Submit
C:\Windows\SysWOW64\Fgcjfbed.exe

Filesize
124KB

MD5
cdb0dfd50ceb6cd54a2934a3b1509af5

SHA1
2b5695d01bafdd9a45af65d772c4e34a712b6f4a

SHA256
3b94a8917ff5b542c48cfaa11eec0190cb57453ee3853da4bdf1a5fb5987d393

SHA512
64862f0e191b47ad8293650285f12dfaf38dc2e446157e50218f8078c39ae81976395057bd94f065dfd8a24ee5f47f926c24ce416d10ea33ea186cca7f89051f

Download Submit
C:\Windows\SysWOW64\Geoapenf.exe

Filesize
78KB

MD5
58e9b49e44dc89ae33af388bf52b4338

SHA1
71a08a7914278ed7bbe439e4f61984536b62e462

SHA256
32469105b23793d472615769fe40177a136028a11ee8846dd8a0cb91a6778121

SHA512
c4f2c22f4c9b862d0674793c769b03ba6b9316b17ad32dc11abc3e0ad6ca368b867279aa4828936ebb3c30f398132260858befac76beb03bd209ae5298ca1692

Download Submit
C:\Windows\SysWOW64\Hpaoan32.dll

Filesize
7KB

MD5
d50d82e9bed5582dfefc71b6e5148a43

SHA1
f331237033e1658caf1493ba2be4bbdecc81ce3e

SHA256
d3df15812cff345f0f6209e80c29d4983a9cc682d11a342abc7e1236893a4d7f

SHA512
96fc1086bbcd09edb102238419929399ab64c9732693dd7019194ada30110ef1cb0be0585672ceb0d30d9ef31f515f2e83dec2ec2f9c64fedc1b210cda4c52c1

Download Submit
C:\Windows\SysWOW64\Icogcjde.exe

Filesize
1.3MB

MD5
02cf8a1742e7a8bd5ea0590dac806d50

SHA1
13ff31e7011fc43c32b03aa95093f23fa0ffb84c

SHA256
56008d476c7f75b6910f66d05f6b54b42f77e94f0140b75ad0b94f0efbb458f1

SHA512
e908a20cb06e084862c09ebd159f1dedda390672438fef66512680808c9496d95cffb88e91e82103ca143deca37c3f1668f96c973322d4aaa5860d46abc9fb26

Download Submit
C:\Windows\SysWOW64\Iqdmghnp.exe

Filesize
264KB

MD5
da98e014d9f864cf3c5345a1d46e7827

SHA1
7c8bb84c42a2b01206ae6aaba171eafb893b8a9f

SHA256
8b45940e0be0ea1d4bc768cb698bd6f2cda0a2ce208b3488f1ea03ff940bea74

SHA512
394100818e2765d16218187244616a9003a25daa092fa402b45a0716dc9aa2961fc4a3926b0c5e5dac856a9523c1c3ca83614070ba73d71077a8e0b4eaae825b

Download Submit
C:\Windows\SysWOW64\Ljijci32.exe

Filesize
64KB

MD5
313d40d031a89de9fc12302d7af0b39b

SHA1
f0c5612cdb832c33cbcfea047065cb440a538a28

SHA256
9752785c80787ecc0404908ea6a62ae371ff8a47492ea96c2c6a176936646398

SHA512
dd0674e8c5aa79c1833bd7a0ba787a8d2cda114d54fa758a8d18881c8bf52941d66acc671f282cb53badceed98889b2f475f4072c7effe889beda25504c7449b

Download Submit
C:\Windows\SysWOW64\Lojmcdgl.exe

Filesize
64KB

MD5
ab8a36b57b326818563e018489d30396

SHA1
b46fa6879370882cd4d7162e192d4ccf990dbede

SHA256
8d05002c56c69e77fa3f4448080a144c0130704e6dc95a3c6a4cc93748f9b18f

SHA512
5e9b4a7ef052ef5703cd0c7d725aafb0c81efc04100061863966d6d59b85fd743f3bd7d5b976304e02f1cddc8e51c20643c252f4a3564dbace2cde787ce7f4a6

Download Submit
C:\Windows\SysWOW64\Mfkkqmiq.exe

Filesize
359KB

MD5
1322d75658858501bf6b7583c6e2772d

SHA1
e202981d308458eebee116ed5d3634531c99970e

SHA256
4343a8dcf0220da050a08ed94087f888f555dfb8cfe7535803b7f176f26a606d

SHA512
364454f5438b7901c4919a74792e4f56f98842bc4b3c819292db7ce51008ead14791c4fde7661e96b5a5250aaf365ae0724da85cc0bf95a7be3f4032e219534d

Download Submit
C:\Windows\SysWOW64\Mig2.scr

Filesize
45KB

MD5
2068eb0c115de7862f8d65b0dd8220bf

SHA1
37e97d01c85c3a591a91f7d8dbd00c9afcd663bf

SHA256
030700d41860d95ec486bf147412c8c3d7b5690b9d5efb46b344b75aef5a7909

SHA512
f3b1644994500d4951e9c4c1d53116ae0bacf35ff1d0871f4cddaf6439c727e4a36a3e274405f4a8b1c3f84872bb37aa7e667fd515f0a230fe2541c9fb2add54

Download Submit
C:\Windows\SysWOW64\Mpagaf32.dll

Filesize
7KB

MD5
a640c62ca62bc25993dc83208c4c2127

SHA1
d9fd30eeb3ac79a32f4a9a7c9fcfdddbe4063023

SHA256
30a2b417e1c3af23182b501cc16f5a27b80b7baa649007803d1e1435afa7064d

SHA512
7bf22c318359e29aa96de106995520ee5ac9aff666acec956c0a3c5ac655ee38a922ea92f2d1235512c7ae1018a28813e84439bda2d6231713d55d8040ebbbed

Download Submit
C:\Windows\SysWOW64\ufpnbevxob.exe

Filesize
512KB

MD5
4e1b664428094cbbac2eec085e0e66f7

SHA1
6f3f4c4025231d0245bd7bc4cfcfbef1be23e357

SHA256
960bec72c885cb28c31b4b3c4721afea0cdf9823a7c8bee6a32953bc8bae7ab8

SHA512
b042163cce17dd549e1598984d305706583e7786bf23e227d21c1d1016acd75037ff2b56cdb27da6e096865c98746cb22290b5b2d0fbe05d58ebbf8588d39761

Download Submit
C:\Windows\SysWOW64\wldap32.exe

Filesize
53KB

MD5
eb639fec5df885c9bd9fa96c8b598857

SHA1
27f435ef8b7eb6aea106516f5dc6e5f62fbc530f

SHA256
4abf4860ae0a85482c2ca76d96cf1125ce883f91d98e54571f3aff2eb78045f0

SHA512
9b8c56e24de8110177c9e974ecab4ddb89b147fbb277caa68799b8a15cae6d5a94c5caf926f81754794f5137818e457f04013f353483e36c1ffcbe552e186eee

Download Submit
C:\Windows\System\KavUpda.exe

Filesize
6.3MB

MD5
dd20f6f9603560b7004dd5c090fac4d0

SHA1
9ee05870872bc80be627052542be093703a4404e

SHA256
1ab60bec37beed8cf66094b06b017af53585afe78795c733860f4821087c6d30

SHA512
7a66fb0ba0ee6349daba5c22f56ce09a8fa27df960a321ec53fffbf0121d8303ffa1682a80351d242532e5ab8f8d88f560ed3f5a81ddcea83847e6c77c424868

Download Submit
C:\Windows\System\tTVuBIJ.exe

Filesize
1.6MB

MD5
5f3b3f72673ef5c1a92b84630fd8fc30

SHA1
5f039beaf4d3a2f65732b515fafdc48f25dce42d

SHA256
412a03517ddb2e17d730d1c1ded527350cfd25c50837046fd283576f70358ec9

SHA512
2a2991c5dc7dec3071efb32389aa53947555446d5bf9c50bbbd48a2197cca4895117df55e892025c3c4b6dd8f44a8a97e462bbd5e540f9ca10ed7a141997be20

Download Submit
C:\Windows\regedt32.sys

Filesize
2KB

MD5
e7d7ec66bd61fac3843c98650b0c68f6

SHA1
a15ae06e1be51038863650746368a71024539bac

SHA256
6475d5ecc14fea090774be55723d2d52b7ec7670527a7dbd61edf28c77944cb8

SHA512
ac9e9893f5a0af03957731445f63279085f164e9a968d706a99d13012e4459314a7ccc32dc48f62379d69e21a0953c13543c9ded38b5ad5fbc346aa442af1ae6

Download Submit
C:\XK\Folder.htt

Filesize
640B

MD5
5d142e7978321fde49abd9a068b64d97

SHA1
70020fcf7f3d6dafb6c8cd7a55395196a487bef4

SHA256
fe222b08327bbfb35cbd627c0526ba7b5755b02ce0a95823a4c0bf58e601d061

SHA512
2351284652a9a1b35006baf4727a85199406e464ac33cb4701a6182e1076aaff022c227dbe4ad6e916eba15ebad08b10719a8e86d5a0f89844a163a7d4a7bbf9

Download Submit
C:\desktop.ini

Filesize
217B

MD5
c00d8433fe598abff197e690231531e0

SHA1
4f6b87a4327ff5343e9e87275d505b9f145a7e42

SHA256
52fb776a91b260bf196016ecb195550cdd9084058fe7b4dd3fe2d4fda1b6470e

SHA512
a71523ec2bd711e381a37baabd89517dff6c6530a435f4382b7f4056f98aff5d6014e85ce3b79bd1f02fdd6adc925cd3fc051752c1069e9eb511a465cd9908e1

Download Submit
C:\nllu.pif

Filesize
97KB

MD5
eb235615645ee7eb8a35b030df837dee

SHA1
79107852da6b4a7018c1c49e56293dd3b77a86ee

SHA256
79848a1037ab1755d7bc488bb1c0407e58714d4293cb7aeb318c4752d08ebaa9

SHA512
06e32f841f4fce898256759c938d50c34afadf43130b3bcf14137424bf56529660b4b2e31ec1a1400ca8a715c26c77db33ba70c9b3b1d05c2c7aa766c51efaf1

Download Submit
C:\pvvpj.exe

Filesize
249KB

MD5
2b145e832674dbe370fab96427c44443

SHA1
b72b341e41d9d96e873765a5655f5c1937cf5e41

SHA256
c224f41f3ce7f77b65f11e4129b1e792da1759a6aad87ebfd196d776df1a034a

SHA512
8becf72975643a993e2f9bd1dde1f688bdb33b0178d98c3a1cc6082542ee52c7a6447205b609ae040e0726701cc653a49aac33327a8c3665cd3a1af3cad1ced1

Download Submit
F:\Autorun.inf

Filesize
237B

MD5
94bcd02c5afd5918b4446345e7a5ded9

SHA1
79839238e84be225132e1382fae6333dfc4906a1

SHA256
5d9f41e4f886926dae2ed8a57807708110d3c6964ab462be21462bff0088d9a1

SHA512
149f6bd49fc3b62fa5f41666bfb3a58060514eec1b61c6aa1ac4c75417c840b028e701eb5533460eb00e2fee8543379564bc47d7477264771d81b99a0caab500

Download Submit
memory/352-1072-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/440-1361-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/440-1536-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/696-1277-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1056-1121-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1060-1165-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1080-1244-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1276-1743-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1276-1745-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1296-1315-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1360-1549-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/1660-1081-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1696-1314-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1752-1501-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1880-1279-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2008-1137-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2128-1074-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2396-1103-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2432-1207-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2460-1754-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2460-1719-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2464-1504-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2464-1278-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2468-1188-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2564-1088-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2708-1063-0x00007FFD5B4C0000-0x00007FFD5D576000-memory.dmp

Filesize
32.7MB

Download
memory/2772-1233-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2808-1548-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2828-1362-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2856-1552-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2856-1336-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2932-1136-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/3056-1313-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/3056-1557-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/3316-1367-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3800-1206-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3816-1183-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3828-1236-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/4000-1094-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4020-1204-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4020-1164-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4132-1515-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4160-1533-0x00000000014A0000-0x00000000014A8000-memory.dmp

Filesize
32KB

Download
memory/4160-1360-0x000000001BB90000-0x000000001BC36000-memory.dmp

Filesize
664KB

Download
memory/4160-1452-0x000000001C760000-0x000000001C7FC000-memory.dmp

Filesize
624KB

Download
memory/4160-1435-0x000000001C1F0000-0x000000001C6BE000-memory.dmp

Filesize
4.8MB

Download
memory/4160-1534-0x000000001C860000-0x000000001C8AC000-memory.dmp

Filesize
304KB

Download
memory/4296-1220-0x00000000001F0000-0x0000000000208000-memory.dmp

Filesize
96KB

Download
memory/4320-1245-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4320-1135-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4332-1114-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/4332-1232-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/4432-1575-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4432-1337-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4452-1205-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/4452-1381-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/4468-1365-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/4484-1282-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4516-1234-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4528-1162-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/4548-1577-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4548-1316-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4552-1503-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/4552-1660-0x0000000024010000-0x0000000024072000-memory.dmp

Filesize
392KB

Download
memory/4552-1667-0x0000000024080000-0x00000000240E2000-memory.dmp

Filesize
392KB

Download
memory/4612-1535-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/4612-1280-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/4752-1669-0x0000000000C80000-0x0000000000C81000-memory.dmp

Filesize
4KB

Download
memory/4752-1668-0x00000000009C0000-0x00000000009C1000-memory.dmp

Filesize
4KB

Download
memory/4756-1182-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/4800-1281-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4820-1163-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5048-1594-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5048-1246-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5140-1513-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/5212-1363-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5224-1382-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5224-1578-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5232-1364-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/5232-1538-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/5268-1366-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/5328-1378-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/5340-1380-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/5356-1541-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/5356-1383-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/5388-1448-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5428-1440-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/5448-1441-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/5496-1442-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5512-1443-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5596-1444-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/5624-1445-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/5636-1446-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/5648-1447-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/5716-1450-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/5756-1551-0x0000000000400000-0x0000000000712000-memory.dmp

Filesize
3.1MB

Download
memory/5756-1757-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/5760-1471-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5792-1472-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5824-1694-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/5824-1696-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/5844-1473-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/5864-1474-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/5872-1475-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5908-1476-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/5920-1550-0x0000000000400000-0x0000000000499000-memory.dmp

Filesize
612KB

Download
memory/5944-1477-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5980-1478-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/6008-1479-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/6036-1480-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/6052-1514-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Extracted

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads