berbew | 2c6b6b7588405b536d24bad92d809fc1a71c389c93154b3571463dd0d8774404

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	240919-t7d5aazaqnd297295cd2ee0b274e6256a45390056f8b4e0b06effc90ab7debfbfd8f82508cN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	240919-t7d5aazaqnd297295cd2ee0b274e6256a45390056f8b4e0b06effc90ab7debfbfd8f82508cN.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	240919-vcb7wazdjn9197688a5e8e960f77e05acb9c6f10d54396b0f5020d64420245523b1df306cfN.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pojcjh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pojcjh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ohnohn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oifeab32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ohnohn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Okgaijaj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Oihagaji.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Olgncmim.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Oifeab32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Olgncmim.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Obcceg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oimkbaed.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	240919-vcb7wazdjn9197688a5e8e960f77e05acb9c6f10d54396b0f5020d64420245523b1df306cfN.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Okjnnj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Okjnnj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Obafpg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Okgaijaj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oihagaji.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ohnohn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Obcceg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Obafpg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Obafpg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Obafpg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ohnohn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oimkbaed.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Disables service(s) 3 TTPs
evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Modifies firewall policy service 3 TTPs 4 IoCs

evasion

Modify Registry

Windows Service

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	240919-vja86azbphebcaee23c39d43b09ea7108ecf1804ad_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	240919-vja86azbphebcaee23c39d43b09ea7108ecf1804ad_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	240919-vja86azbphebcaee23c39d43b09ea7108ecf1804ad_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\Downloads\240919-vja86azbphebcaee23c39d43b09ea7108ecf1804ad_JaffaCakes118.exe = "C:\\Users\\Admin\\Downloads\\240919-vja86azbphebcaee23c39d43b09ea7108ecf1804ad_JaffaCakes118.exe:*:enabled:@shell32.dll,-1"	240919-vja86azbphebcaee23c39d43b09ea7108ecf1804ad_JaffaCakes118.exe

Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
23832	Process not Found

Modifies Windows Firewall 2 TTPs 3 IoCs

evasion

Windows Service

Disable or Modify System Firewall

T1562.004

pid	Process
23108	Process not Found
53380	Process not Found
5768	Process not Found

Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 17 IoCs

pid	Process
2532	240919-vja86azbphebcaee23c39d43b09ea7108ecf1804ad_JaffaCakes118.exe
1404	240919-t7d5aazaqnd297295cd2ee0b274e6256a45390056f8b4e0b06effc90ab7debfbfd8f82508cN.exe
2172	Oifeab32.exe
4972	Okgaijaj.exe
4620	Oihagaji.exe
828	Olgncmim.exe
4988	240919-vcb7wazdjn9197688a5e8e960f77e05acb9c6f10d54396b0f5020d64420245523b1df306cfN.exe
4108	Okjnnj32.exe
2076	240919-vk9s4szgnkebcc86bf3bd43460d200b9ce1f492e03_JaffaCakes118.exe
2896	Obafpg32.exe
1864	Obafpg32.exe
5004	Ohnohn32.exe
952	Ohnohn32.exe
4236	Obcceg32.exe
4844	Oimkbaed.exe
3236	Pojcjh32.exe
2788	Pcepkfld.exe

Loads dropped DLL 20 IoCs

pid	Process
1928	DoomRat.exe
1928	DoomRat.exe
1928	DoomRat.exe
1928	DoomRat.exe
1928	DoomRat.exe
1928	DoomRat.exe
1928	DoomRat.exe
1928	DoomRat.exe
1928	DoomRat.exe
1928	DoomRat.exe
1928	DoomRat.exe
1928	DoomRat.exe
1928	DoomRat.exe
1928	DoomRat.exe
1928	DoomRat.exe
1928	DoomRat.exe
1928	DoomRat.exe
1928	DoomRat.exe
1928	DoomRat.exe
1928	DoomRat.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/3304-345-0x0000000000400000-0x000000000040D000-memory.dmp	upx
behavioral1/memory/3304-405-0x0000000000400000-0x000000000040D000-memory.dmp	upx
behavioral1/memory/824-454-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral1/memory/824-557-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral1/files/0x000700000001ad65-1321.dat	upx
behavioral1/files/0x000700000001afb1-20065.dat	upx
behavioral1/files/0x000300000002e2e3-12899.dat	upx

Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Software\Microsoft\Windows\CurrentVersion\Run\KB737982.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\KB737982.exe\""	240919-vja86azbphebcaee23c39d43b09ea7108ecf1804ad_JaffaCakes118.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
1	pastebin.com
2	pastebin.com

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in System32 directory 40 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Ohnohn32.exe	Obafpg32.exe
File created	C:\Windows\SysWOW64\Palbkhoj.dll	Ohnohn32.exe
File opened for modification	C:\Windows\SysWOW64\Palbkhoj.dll	Ohnohn32.exe
File opened for modification	C:\Windows\SysWOW64\Oifeab32.exe	240919-t7d5aazaqnd297295cd2ee0b274e6256a45390056f8b4e0b06effc90ab7debfbfd8f82508cN.exe
File opened for modification	C:\Windows\SysWOW64\Oihagaji.exe	Okgaijaj.exe
File created	C:\Windows\SysWOW64\Obcceg32.exe	Ohnohn32.exe
File opened for modification	C:\Windows\SysWOW64\Obcceg32.exe	Ohnohn32.exe
File created	C:\Windows\SysWOW64\Obafpg32.exe	240919-vcb7wazdjn9197688a5e8e960f77e05acb9c6f10d54396b0f5020d64420245523b1df306cfN.exe
File opened for modification	C:\Windows\SysWOW64\Obafpg32.exe	240919-vcb7wazdjn9197688a5e8e960f77e05acb9c6f10d54396b0f5020d64420245523b1df306cfN.exe
File created	C:\Windows\SysWOW64\Oihagaji.exe	Okgaijaj.exe
File created	C:\Windows\SysWOW64\Gdliee32.dll	Pojcjh32.exe
File created	C:\Windows\SysWOW64\Olgncmim.exe	Oihagaji.exe
File opened for modification	C:\Windows\SysWOW64\Okjnnj32.exe	Olgncmim.exe
File created	C:\Windows\SysWOW64\Obafpg32.exe	Okjnnj32.exe
File opened for modification	C:\Windows\SysWOW64\Cmncbodd.dll	Okjnnj32.exe
File created	C:\Windows\SysWOW64\Ohnohn32.exe	Obafpg32.exe
File created	C:\Windows\SysWOW64\Oimkbaed.exe	Obcceg32.exe
File created	C:\Windows\SysWOW64\Dbmiag32.dll	Oifeab32.exe
File created	C:\Windows\SysWOW64\Kloeol32.dll	Okgaijaj.exe
File opened for modification	C:\Windows\SysWOW64\Pcepkfld.exe	Pojcjh32.exe
File opened for modification	C:\Windows\SysWOW64\Ohnohn32.exe	Obafpg32.exe
File created	C:\Windows\SysWOW64\Hmkjpibb.dll	Obafpg32.exe
File opened for modification	C:\Windows\SysWOW64\Hmkjpibb.dll	Obafpg32.exe
File created	C:\Windows\SysWOW64\Pcepkfld.exe	Pojcjh32.exe
File created	C:\Windows\SysWOW64\Okgaijaj.exe	Oifeab32.exe
File created	C:\Windows\SysWOW64\Dpildobq.dll	Oihagaji.exe
File opened for modification	C:\Windows\SysWOW64\Obcceg32.exe	Ohnohn32.exe
File created	C:\Windows\SysWOW64\Iglhgnlj.dll	Obcceg32.exe
File created	C:\Windows\SysWOW64\Pojcjh32.exe	Oimkbaed.exe
File created	C:\Windows\SysWOW64\Hnnpaa32.dll	Oimkbaed.exe
File opened for modification	C:\Windows\SysWOW64\Olgncmim.exe	Oihagaji.exe
File created	C:\Windows\SysWOW64\Fjecoi32.dll	Olgncmim.exe
File opened for modification	C:\Windows\SysWOW64\Pojcjh32.exe	Oimkbaed.exe
File created	C:\Windows\SysWOW64\Cmncbodd.dll	240919-vcb7wazdjn9197688a5e8e960f77e05acb9c6f10d54396b0f5020d64420245523b1df306cfN.exe
File opened for modification	C:\Windows\SysWOW64\Oimkbaed.exe	Obcceg32.exe
File opened for modification	C:\Windows\SysWOW64\Okgaijaj.exe	Oifeab32.exe
File created	C:\Windows\SysWOW64\Okjnnj32.exe	Olgncmim.exe
File created	C:\Windows\SysWOW64\Obcceg32.exe	Ohnohn32.exe
File created	C:\Windows\SysWOW64\Oifeab32.exe	240919-t7d5aazaqnd297295cd2ee0b274e6256a45390056f8b4e0b06effc90ab7debfbfd8f82508cN.exe
File created	C:\Windows\SysWOW64\Jbnnbmfj.dll	240919-t7d5aazaqnd297295cd2ee0b274e6256a45390056f8b4e0b06effc90ab7debfbfd8f82508cN.exe

Launches sc.exe 7 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
35648	Process not Found
1876	sc.exe
1884	sc.exe
5056	Process not Found
41592	Process not Found
27604	Process not Found
21532	Process not Found

Program crash 4 IoCs

pid	pid_target	Process	procid_target
2208	2532	WerFault.exe	76
6128	5476	WerFault.exe	187
5884	5760	WerFault.exe	190
6300	7084	WerFault.exe	306

System Location Discovery: System Language Discovery 1 TTPs 16 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pojcjh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	240919-vja86azbphebcaee23c39d43b09ea7108ecf1804ad_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ohnohn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Obcceg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Obafpg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	240919-t7d5aazaqnd297295cd2ee0b274e6256a45390056f8b4e0b06effc90ab7debfbfd8f82508cN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oifeab32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Okgaijaj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oihagaji.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Olgncmim.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Okjnnj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ohnohn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oimkbaed.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	240919-vcb7wazdjn9197688a5e8e960f77e05acb9c6f10d54396b0f5020d64420245523b1df306cfN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Obafpg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	240919-vk9s4szgnkebcc86bf3bd43460d200b9ce1f492e03_JaffaCakes118.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
34776	Process not Found
47588	Process not Found
44648	Process not Found
38832	Process not Found

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
42196	Process not Found
43728	Process not Found

Modifies registry class 48 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	240919-vcb7wazdjn9197688a5e8e960f77e05acb9c6f10d54396b0f5020d64420245523b1df306cfN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Oimkbaed.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pojcjh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jbnnbmfj.dll"	240919-t7d5aazaqnd297295cd2ee0b274e6256a45390056f8b4e0b06effc90ab7debfbfd8f82508cN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Oifeab32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Okgaijaj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Olgncmim.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hmkjpibb.dll"	Obafpg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ohnohn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	240919-t7d5aazaqnd297295cd2ee0b274e6256a45390056f8b4e0b06effc90ab7debfbfd8f82508cN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}	240919-vcb7wazdjn9197688a5e8e960f77e05acb9c6f10d54396b0f5020d64420245523b1df306cfN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cmncbodd.dll"	240919-vcb7wazdjn9197688a5e8e960f77e05acb9c6f10d54396b0f5020d64420245523b1df306cfN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Okjnnj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ohnohn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Obcceg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Okgaijaj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Oihagaji.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Okjnnj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Obafpg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hmkjpibb.dll"	Obafpg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Obcceg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hnnpaa32.dll"	Oimkbaed.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}	240919-t7d5aazaqnd297295cd2ee0b274e6256a45390056f8b4e0b06effc90ab7debfbfd8f82508cN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dbmiag32.dll"	Oifeab32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Olgncmim.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Palbkhoj.dll"	Ohnohn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Palbkhoj.dll"	Ohnohn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	240919-t7d5aazaqnd297295cd2ee0b274e6256a45390056f8b4e0b06effc90ab7debfbfd8f82508cN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	240919-t7d5aazaqnd297295cd2ee0b274e6256a45390056f8b4e0b06effc90ab7debfbfd8f82508cN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dpildobq.dll"	Oihagaji.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	240919-vcb7wazdjn9197688a5e8e960f77e05acb9c6f10d54396b0f5020d64420245523b1df306cfN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	240919-vcb7wazdjn9197688a5e8e960f77e05acb9c6f10d54396b0f5020d64420245523b1df306cfN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Obafpg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pojcjh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Oifeab32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kloeol32.dll"	Okgaijaj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	240919-vcb7wazdjn9197688a5e8e960f77e05acb9c6f10d54396b0f5020d64420245523b1df306cfN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Obafpg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iglhgnlj.dll"	Obcceg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gdliee32.dll"	Pojcjh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	240919-t7d5aazaqnd297295cd2ee0b274e6256a45390056f8b4e0b06effc90ab7debfbfd8f82508cN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Oihagaji.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fjecoi32.dll"	Olgncmim.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cmncbodd.dll"	Okjnnj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Obafpg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ohnohn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ohnohn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Oimkbaed.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

pid	Process
11372	Process not Found

Runs net.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2532	240919-vja86azbphebcaee23c39d43b09ea7108ecf1804ad_JaffaCakes118.exe
2532	240919-vja86azbphebcaee23c39d43b09ea7108ecf1804ad_JaffaCakes118.exe

Suspicious behavior: MapViewOfSection 64 IoCs

pid	Process
2532	240919-vja86azbphebcaee23c39d43b09ea7108ecf1804ad_JaffaCakes118.exe
2532	240919-vja86azbphebcaee23c39d43b09ea7108ecf1804ad_JaffaCakes118.exe
2532	240919-vja86azbphebcaee23c39d43b09ea7108ecf1804ad_JaffaCakes118.exe
2532	240919-vja86azbphebcaee23c39d43b09ea7108ecf1804ad_JaffaCakes118.exe
2532	240919-vja86azbphebcaee23c39d43b09ea7108ecf1804ad_JaffaCakes118.exe
2532	240919-vja86azbphebcaee23c39d43b09ea7108ecf1804ad_JaffaCakes118.exe
2532	240919-vja86azbphebcaee23c39d43b09ea7108ecf1804ad_JaffaCakes118.exe
2532	240919-vja86azbphebcaee23c39d43b09ea7108ecf1804ad_JaffaCakes118.exe
2532	240919-vja86azbphebcaee23c39d43b09ea7108ecf1804ad_JaffaCakes118.exe
2532	240919-vja86azbphebcaee23c39d43b09ea7108ecf1804ad_JaffaCakes118.exe
2532	240919-vja86azbphebcaee23c39d43b09ea7108ecf1804ad_JaffaCakes118.exe
2532	240919-vja86azbphebcaee23c39d43b09ea7108ecf1804ad_JaffaCakes118.exe
2532	240919-vja86azbphebcaee23c39d43b09ea7108ecf1804ad_JaffaCakes118.exe
2532	240919-vja86azbphebcaee23c39d43b09ea7108ecf1804ad_JaffaCakes118.exe
2532	240919-vja86azbphebcaee23c39d43b09ea7108ecf1804ad_JaffaCakes118.exe
2532	240919-vja86azbphebcaee23c39d43b09ea7108ecf1804ad_JaffaCakes118.exe
2532	240919-vja86azbphebcaee23c39d43b09ea7108ecf1804ad_JaffaCakes118.exe
2532	240919-vja86azbphebcaee23c39d43b09ea7108ecf1804ad_JaffaCakes118.exe
2532	240919-vja86azbphebcaee23c39d43b09ea7108ecf1804ad_JaffaCakes118.exe
2532	240919-vja86azbphebcaee23c39d43b09ea7108ecf1804ad_JaffaCakes118.exe
2532	240919-vja86azbphebcaee23c39d43b09ea7108ecf1804ad_JaffaCakes118.exe
2532	240919-vja86azbphebcaee23c39d43b09ea7108ecf1804ad_JaffaCakes118.exe
2532	240919-vja86azbphebcaee23c39d43b09ea7108ecf1804ad_JaffaCakes118.exe
2532	240919-vja86azbphebcaee23c39d43b09ea7108ecf1804ad_JaffaCakes118.exe
2532	240919-vja86azbphebcaee23c39d43b09ea7108ecf1804ad_JaffaCakes118.exe
2532	240919-vja86azbphebcaee23c39d43b09ea7108ecf1804ad_JaffaCakes118.exe
2532	240919-vja86azbphebcaee23c39d43b09ea7108ecf1804ad_JaffaCakes118.exe
2532	240919-vja86azbphebcaee23c39d43b09ea7108ecf1804ad_JaffaCakes118.exe
2532	240919-vja86azbphebcaee23c39d43b09ea7108ecf1804ad_JaffaCakes118.exe
2532	240919-vja86azbphebcaee23c39d43b09ea7108ecf1804ad_JaffaCakes118.exe
2532	240919-vja86azbphebcaee23c39d43b09ea7108ecf1804ad_JaffaCakes118.exe
2532	240919-vja86azbphebcaee23c39d43b09ea7108ecf1804ad_JaffaCakes118.exe
2532	240919-vja86azbphebcaee23c39d43b09ea7108ecf1804ad_JaffaCakes118.exe
2532	240919-vja86azbphebcaee23c39d43b09ea7108ecf1804ad_JaffaCakes118.exe
2532	240919-vja86azbphebcaee23c39d43b09ea7108ecf1804ad_JaffaCakes118.exe
2532	240919-vja86azbphebcaee23c39d43b09ea7108ecf1804ad_JaffaCakes118.exe
2532	240919-vja86azbphebcaee23c39d43b09ea7108ecf1804ad_JaffaCakes118.exe
2532	240919-vja86azbphebcaee23c39d43b09ea7108ecf1804ad_JaffaCakes118.exe
2532	240919-vja86azbphebcaee23c39d43b09ea7108ecf1804ad_JaffaCakes118.exe
2532	240919-vja86azbphebcaee23c39d43b09ea7108ecf1804ad_JaffaCakes118.exe
2532	240919-vja86azbphebcaee23c39d43b09ea7108ecf1804ad_JaffaCakes118.exe
2532	240919-vja86azbphebcaee23c39d43b09ea7108ecf1804ad_JaffaCakes118.exe
2532	240919-vja86azbphebcaee23c39d43b09ea7108ecf1804ad_JaffaCakes118.exe
2532	240919-vja86azbphebcaee23c39d43b09ea7108ecf1804ad_JaffaCakes118.exe
2532	240919-vja86azbphebcaee23c39d43b09ea7108ecf1804ad_JaffaCakes118.exe
2532	240919-vja86azbphebcaee23c39d43b09ea7108ecf1804ad_JaffaCakes118.exe
2532	240919-vja86azbphebcaee23c39d43b09ea7108ecf1804ad_JaffaCakes118.exe
2532	240919-vja86azbphebcaee23c39d43b09ea7108ecf1804ad_JaffaCakes118.exe
2532	240919-vja86azbphebcaee23c39d43b09ea7108ecf1804ad_JaffaCakes118.exe
2532	240919-vja86azbphebcaee23c39d43b09ea7108ecf1804ad_JaffaCakes118.exe
2532	240919-vja86azbphebcaee23c39d43b09ea7108ecf1804ad_JaffaCakes118.exe
2532	240919-vja86azbphebcaee23c39d43b09ea7108ecf1804ad_JaffaCakes118.exe
2532	240919-vja86azbphebcaee23c39d43b09ea7108ecf1804ad_JaffaCakes118.exe
2532	240919-vja86azbphebcaee23c39d43b09ea7108ecf1804ad_JaffaCakes118.exe
2532	240919-vja86azbphebcaee23c39d43b09ea7108ecf1804ad_JaffaCakes118.exe
2532	240919-vja86azbphebcaee23c39d43b09ea7108ecf1804ad_JaffaCakes118.exe
2532	240919-vja86azbphebcaee23c39d43b09ea7108ecf1804ad_JaffaCakes118.exe
2532	240919-vja86azbphebcaee23c39d43b09ea7108ecf1804ad_JaffaCakes118.exe
2532	240919-vja86azbphebcaee23c39d43b09ea7108ecf1804ad_JaffaCakes118.exe
2532	240919-vja86azbphebcaee23c39d43b09ea7108ecf1804ad_JaffaCakes118.exe
2532	240919-vja86azbphebcaee23c39d43b09ea7108ecf1804ad_JaffaCakes118.exe
2532	240919-vja86azbphebcaee23c39d43b09ea7108ecf1804ad_JaffaCakes118.exe
2532	240919-vja86azbphebcaee23c39d43b09ea7108ecf1804ad_JaffaCakes118.exe
2532	240919-vja86azbphebcaee23c39d43b09ea7108ecf1804ad_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	2532	240919-vja86azbphebcaee23c39d43b09ea7108ecf1804ad_JaffaCakes118.exe
Token: SeImpersonatePrivilege	2076	240919-vk9s4szgnkebcc86bf3bd43460d200b9ce1f492e03_JaffaCakes118.exe
Token: SeTcbPrivilege	2076	240919-vk9s4szgnkebcc86bf3bd43460d200b9ce1f492e03_JaffaCakes118.exe
Token: SeChangeNotifyPrivilege	2076	240919-vk9s4szgnkebcc86bf3bd43460d200b9ce1f492e03_JaffaCakes118.exe
Token: SeCreateTokenPrivilege	2076	240919-vk9s4szgnkebcc86bf3bd43460d200b9ce1f492e03_JaffaCakes118.exe
Token: SeBackupPrivilege	2076	240919-vk9s4szgnkebcc86bf3bd43460d200b9ce1f492e03_JaffaCakes118.exe
Token: SeRestorePrivilege	2076	240919-vk9s4szgnkebcc86bf3bd43460d200b9ce1f492e03_JaffaCakes118.exe
Token: SeIncreaseQuotaPrivilege	2076	240919-vk9s4szgnkebcc86bf3bd43460d200b9ce1f492e03_JaffaCakes118.exe
Token: SeAssignPrimaryTokenPrivilege	2076	240919-vk9s4szgnkebcc86bf3bd43460d200b9ce1f492e03_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2804 wrote to memory of 1928	2804	DoomRat.exe	74
PID 2804 wrote to memory of 1928	2804	DoomRat.exe	74
PID 1928 wrote to memory of 3984	1928	DoomRat.exe	75
PID 1928 wrote to memory of 3984	1928	DoomRat.exe	75
PID 1928 wrote to memory of 2532	1928	DoomRat.exe	76
PID 1928 wrote to memory of 2532	1928	DoomRat.exe	76
PID 1928 wrote to memory of 2532	1928	DoomRat.exe	76
PID 2532 wrote to memory of 556	2532	240919-vja86azbphebcaee23c39d43b09ea7108ecf1804ad_JaffaCakes118.exe	5
PID 2532 wrote to memory of 556	2532	240919-vja86azbphebcaee23c39d43b09ea7108ecf1804ad_JaffaCakes118.exe	5
PID 2532 wrote to memory of 556	2532	240919-vja86azbphebcaee23c39d43b09ea7108ecf1804ad_JaffaCakes118.exe	5
PID 2532 wrote to memory of 556	2532	240919-vja86azbphebcaee23c39d43b09ea7108ecf1804ad_JaffaCakes118.exe	5
PID 2532 wrote to memory of 556	2532	240919-vja86azbphebcaee23c39d43b09ea7108ecf1804ad_JaffaCakes118.exe	5
PID 2532 wrote to memory of 556	2532	240919-vja86azbphebcaee23c39d43b09ea7108ecf1804ad_JaffaCakes118.exe	5
PID 2532 wrote to memory of 640	2532	240919-vja86azbphebcaee23c39d43b09ea7108ecf1804ad_JaffaCakes118.exe	7
PID 2532 wrote to memory of 640	2532	240919-vja86azbphebcaee23c39d43b09ea7108ecf1804ad_JaffaCakes118.exe	7
PID 2532 wrote to memory of 640	2532	240919-vja86azbphebcaee23c39d43b09ea7108ecf1804ad_JaffaCakes118.exe	7
PID 2532 wrote to memory of 640	2532	240919-vja86azbphebcaee23c39d43b09ea7108ecf1804ad_JaffaCakes118.exe	7
PID 2532 wrote to memory of 640	2532	240919-vja86azbphebcaee23c39d43b09ea7108ecf1804ad_JaffaCakes118.exe	7
PID 2532 wrote to memory of 640	2532	240919-vja86azbphebcaee23c39d43b09ea7108ecf1804ad_JaffaCakes118.exe	7
PID 2532 wrote to memory of 724	2532	240919-vja86azbphebcaee23c39d43b09ea7108ecf1804ad_JaffaCakes118.exe	8
PID 2532 wrote to memory of 724	2532	240919-vja86azbphebcaee23c39d43b09ea7108ecf1804ad_JaffaCakes118.exe	8
PID 2532 wrote to memory of 724	2532	240919-vja86azbphebcaee23c39d43b09ea7108ecf1804ad_JaffaCakes118.exe	8
PID 2532 wrote to memory of 724	2532	240919-vja86azbphebcaee23c39d43b09ea7108ecf1804ad_JaffaCakes118.exe	8
PID 2532 wrote to memory of 724	2532	240919-vja86azbphebcaee23c39d43b09ea7108ecf1804ad_JaffaCakes118.exe	8
PID 2532 wrote to memory of 724	2532	240919-vja86azbphebcaee23c39d43b09ea7108ecf1804ad_JaffaCakes118.exe	8
PID 2532 wrote to memory of 732	2532	240919-vja86azbphebcaee23c39d43b09ea7108ecf1804ad_JaffaCakes118.exe	9
PID 2532 wrote to memory of 732	2532	240919-vja86azbphebcaee23c39d43b09ea7108ecf1804ad_JaffaCakes118.exe	9
PID 2532 wrote to memory of 732	2532	240919-vja86azbphebcaee23c39d43b09ea7108ecf1804ad_JaffaCakes118.exe	9
PID 2532 wrote to memory of 732	2532	240919-vja86azbphebcaee23c39d43b09ea7108ecf1804ad_JaffaCakes118.exe	9
PID 2532 wrote to memory of 732	2532	240919-vja86azbphebcaee23c39d43b09ea7108ecf1804ad_JaffaCakes118.exe	9
PID 2532 wrote to memory of 732	2532	240919-vja86azbphebcaee23c39d43b09ea7108ecf1804ad_JaffaCakes118.exe	9
PID 2532 wrote to memory of 740	2532	240919-vja86azbphebcaee23c39d43b09ea7108ecf1804ad_JaffaCakes118.exe	10
PID 2532 wrote to memory of 740	2532	240919-vja86azbphebcaee23c39d43b09ea7108ecf1804ad_JaffaCakes118.exe	10
PID 2532 wrote to memory of 740	2532	240919-vja86azbphebcaee23c39d43b09ea7108ecf1804ad_JaffaCakes118.exe	10
PID 2532 wrote to memory of 740	2532	240919-vja86azbphebcaee23c39d43b09ea7108ecf1804ad_JaffaCakes118.exe	10
PID 2532 wrote to memory of 740	2532	240919-vja86azbphebcaee23c39d43b09ea7108ecf1804ad_JaffaCakes118.exe	10
PID 2532 wrote to memory of 740	2532	240919-vja86azbphebcaee23c39d43b09ea7108ecf1804ad_JaffaCakes118.exe	10
PID 2532 wrote to memory of 808	2532	240919-vja86azbphebcaee23c39d43b09ea7108ecf1804ad_JaffaCakes118.exe	11
PID 2532 wrote to memory of 808	2532	240919-vja86azbphebcaee23c39d43b09ea7108ecf1804ad_JaffaCakes118.exe	11
PID 2532 wrote to memory of 808	2532	240919-vja86azbphebcaee23c39d43b09ea7108ecf1804ad_JaffaCakes118.exe	11
PID 2532 wrote to memory of 808	2532	240919-vja86azbphebcaee23c39d43b09ea7108ecf1804ad_JaffaCakes118.exe	11
PID 2532 wrote to memory of 808	2532	240919-vja86azbphebcaee23c39d43b09ea7108ecf1804ad_JaffaCakes118.exe	11
PID 2532 wrote to memory of 808	2532	240919-vja86azbphebcaee23c39d43b09ea7108ecf1804ad_JaffaCakes118.exe	11
PID 2532 wrote to memory of 856	2532	240919-vja86azbphebcaee23c39d43b09ea7108ecf1804ad_JaffaCakes118.exe	12
PID 2532 wrote to memory of 856	2532	240919-vja86azbphebcaee23c39d43b09ea7108ecf1804ad_JaffaCakes118.exe	12
PID 2532 wrote to memory of 856	2532	240919-vja86azbphebcaee23c39d43b09ea7108ecf1804ad_JaffaCakes118.exe	12
PID 2532 wrote to memory of 856	2532	240919-vja86azbphebcaee23c39d43b09ea7108ecf1804ad_JaffaCakes118.exe	12
PID 2532 wrote to memory of 856	2532	240919-vja86azbphebcaee23c39d43b09ea7108ecf1804ad_JaffaCakes118.exe	12
PID 2532 wrote to memory of 856	2532	240919-vja86azbphebcaee23c39d43b09ea7108ecf1804ad_JaffaCakes118.exe	12
PID 2532 wrote to memory of 904	2532	240919-vja86azbphebcaee23c39d43b09ea7108ecf1804ad_JaffaCakes118.exe	13
PID 2532 wrote to memory of 904	2532	240919-vja86azbphebcaee23c39d43b09ea7108ecf1804ad_JaffaCakes118.exe	13
PID 2532 wrote to memory of 904	2532	240919-vja86azbphebcaee23c39d43b09ea7108ecf1804ad_JaffaCakes118.exe	13
PID 2532 wrote to memory of 904	2532	240919-vja86azbphebcaee23c39d43b09ea7108ecf1804ad_JaffaCakes118.exe	13
PID 2532 wrote to memory of 904	2532	240919-vja86azbphebcaee23c39d43b09ea7108ecf1804ad_JaffaCakes118.exe	13
PID 2532 wrote to memory of 904	2532	240919-vja86azbphebcaee23c39d43b09ea7108ecf1804ad_JaffaCakes118.exe	13
PID 2532 wrote to memory of 1000	2532	240919-vja86azbphebcaee23c39d43b09ea7108ecf1804ad_JaffaCakes118.exe	14
PID 2532 wrote to memory of 1000	2532	240919-vja86azbphebcaee23c39d43b09ea7108ecf1804ad_JaffaCakes118.exe	14
PID 2532 wrote to memory of 1000	2532	240919-vja86azbphebcaee23c39d43b09ea7108ecf1804ad_JaffaCakes118.exe	14
PID 2532 wrote to memory of 1000	2532	240919-vja86azbphebcaee23c39d43b09ea7108ecf1804ad_JaffaCakes118.exe	14
PID 2532 wrote to memory of 1000	2532	240919-vja86azbphebcaee23c39d43b09ea7108ecf1804ad_JaffaCakes118.exe	14
PID 2532 wrote to memory of 1000	2532	240919-vja86azbphebcaee23c39d43b09ea7108ecf1804ad_JaffaCakes118.exe	14
PID 2532 wrote to memory of 1020	2532	240919-vja86azbphebcaee23c39d43b09ea7108ecf1804ad_JaffaCakes118.exe	15
PID 2532 wrote to memory of 1020	2532	240919-vja86azbphebcaee23c39d43b09ea7108ecf1804ad_JaffaCakes118.exe	15
PID 2532 wrote to memory of 1020	2532	240919-vja86azbphebcaee23c39d43b09ea7108ecf1804ad_JaffaCakes118.exe	15

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
45828	Process not Found

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:556
- C:\Windows\system32\fontdrvhost.exe
  "fontdrvhost.exe"
  2⤵
  PID:740
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:1000

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:640

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k dcomlaunch -s PlugPlay
1⤵
PID:724

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:732

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
1⤵
PID:808
- C:\Windows\system32\wbem\unsecapp.exe
  C:\Windows\system32\wbem\unsecapp.exe -Embedding
  2⤵
  PID:2924
- C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe
  "C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca
  2⤵
  PID:3712
- C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
  "C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca
  2⤵
  PID:3724
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:3972
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:1016
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:2180
- C:\Windows\system32\ApplicationFrameHost.exe
  C:\Windows\system32\ApplicationFrameHost.exe -Embedding
  2⤵
  PID:2912
- C:\Windows\System32\InstallAgent.exe
  C:\Windows\System32\InstallAgent.exe -Embedding
  2⤵
  PID:5076
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}
  2⤵
  PID:784

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k rpcss
1⤵
PID:856

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k dcomlaunch -s LSM
1⤵
PID:904

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
1⤵
PID:1020

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s lmhosts
1⤵
PID:364

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s NcbService
1⤵
PID:876

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s EventLog
1⤵
PID:1080

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Schedule
1⤵
PID:1092
- c:\windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:3256

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
1⤵
PID:1100

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservice -s nsi
1⤵
PID:1188

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
1⤵
PID:1268

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservice -s EventSystem
1⤵
PID:1316

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Themes
1⤵
PID:1324

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s Dhcp
1⤵
PID:1380

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s UserManager
1⤵
PID:1464
- c:\windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:3052

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s SENS
1⤵
PID:1484

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s AudioEndpointBuilder
1⤵
PID:1532

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k networkservice -s NlaSvc
1⤵
PID:1592

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
1⤵
PID:1640

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k networkservice -s Dnscache
1⤵
PID:1648

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
1⤵
PID:1776

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted
1⤵
PID:1792

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservice -s netprofm
1⤵
PID:1808

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k appmodel -s StateRepository
1⤵
PID:1820

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
1⤵
PID:1892

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2040

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k networkservice -s LanmanWorkstation
1⤵
PID:2088

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
1⤵
PID:2192

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k appmodel -s tiledatamodelsvc
1⤵
PID:2324

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
1⤵
PID:2360

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k networkservicenetworkrestricted -s PolicyAgent
1⤵
PID:2368

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
1⤵
PID:2408

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k networkservice -s CryptSvc
1⤵
PID:2512

C:\Windows\sysmon.exe
C:\Windows\sysmon.exe
1⤵
PID:2536

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s TrkWks
1⤵
PID:2564

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s WpnService
1⤵
PID:2572

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Browser
1⤵
PID:2740

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k unistacksvcgroup -s CDPUserSvc
1⤵
PID:2340

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s TokenBroker
1⤵
PID:3284

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3448
- C:\Users\Admin\AppData\Local\Temp\DoomRat.exe
  "C:\Users\Admin\AppData\Local\Temp\DoomRat.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2804
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3856
- - C:\Users\Admin\AppData\Local\Temp\DoomRat.exe
    "C:\Users\Admin\AppData\Local\Temp\DoomRat.exe"
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1928
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c cls
      4⤵
      PID:3984
  - - C:\Users\Admin\Downloads\240919-vja86azbphebcaee23c39d43b09ea7108ecf1804ad_JaffaCakes118.exe
      C:\Users\Admin\Downloads\240919-vja86azbphebcaee23c39d43b09ea7108ecf1804ad_JaffaCakes118.exe
      4⤵
      Modifies firewall policy service
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2532
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2532 -s 828
        5⤵
        Program crash
        
        PID:2208
  - - C:\Users\Admin\Downloads\240919-t7d5aazaqnd297295cd2ee0b274e6256a45390056f8b4e0b06effc90ab7debfbfd8f82508cN.exe
      C:\Users\Admin\Downloads\240919-t7d5aazaqnd297295cd2ee0b274e6256a45390056f8b4e0b06effc90ab7debfbfd8f82508cN.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:1404
    - - C:\Windows\SysWOW64\Oifeab32.exe
        
        C:\Windows\system32\Oifeab32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2172
      - C:\Windows\SysWOW64\Okgaijaj.exe
        
        C:\Windows\system32\Okgaijaj.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4972
        
        C:\Windows\SysWOW64\Oihagaji.exe
        
        C:\Windows\system32\Oihagaji.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4620
        
        C:\Windows\SysWOW64\Olgncmim.exe
        
        C:\Windows\system32\Olgncmim.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:828
        
        C:\Windows\SysWOW64\Okjnnj32.exe
        
        C:\Windows\system32\Okjnnj32.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4108
        
        C:\Windows\SysWOW64\Obafpg32.exe
        
        C:\Windows\system32\Obafpg32.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1864
        
        C:\Windows\SysWOW64\Ohnohn32.exe
        
        C:\Windows\system32\Ohnohn32.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:952
  - - C:\Users\Admin\Downloads\240919-vcb7wazdjn9197688a5e8e960f77e05acb9c6f10d54396b0f5020d64420245523b1df306cfN.exe
      C:\Users\Admin\Downloads\240919-vcb7wazdjn9197688a5e8e960f77e05acb9c6f10d54396b0f5020d64420245523b1df306cfN.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:4988
    - - C:\Windows\SysWOW64\Obafpg32.exe
        
        C:\Windows\system32\Obafpg32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2896
      - C:\Windows\SysWOW64\Ohnohn32.exe
        
        C:\Windows\system32\Ohnohn32.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5004
        
        C:\Windows\SysWOW64\Obcceg32.exe
        
        C:\Windows\system32\Obcceg32.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4236
        
        C:\Windows\SysWOW64\Oimkbaed.exe
        
        C:\Windows\system32\Oimkbaed.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4844
        
        C:\Windows\SysWOW64\Pojcjh32.exe
        
        C:\Windows\system32\Pojcjh32.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3236
        
        C:\Windows\SysWOW64\Pcepkfld.exe
        
        C:\Windows\system32\Pcepkfld.exe
        10⤵
        Executes dropped EXE
        
        PID:2788
        
        C:\Windows\SysWOW64\Pkadoiip.exe
        
        C:\Windows\system32\Pkadoiip.exe
        11⤵
        
        PID:1292
        
        C:\Windows\SysWOW64\Polppg32.exe
        
        C:\Windows\system32\Polppg32.exe
        12⤵
        
        PID:4556
        
        C:\Windows\SysWOW64\Pibdmp32.exe
        
        C:\Windows\system32\Pibdmp32.exe
        13⤵
        
        PID:504
        
        C:\Windows\SysWOW64\Pkcadhgm.exe
        
        C:\Windows\system32\Pkcadhgm.exe
        14⤵
        
        PID:1984
        
        C:\Windows\SysWOW64\Plbmokop.exe
        
        C:\Windows\system32\Plbmokop.exe
        15⤵
        
        PID:4360
        
        C:\Windows\SysWOW64\Pcmeke32.exe
        
        C:\Windows\system32\Pcmeke32.exe
        16⤵
        
        PID:2432
        
        C:\Windows\SysWOW64\Plejdkmm.exe
        
        C:\Windows\system32\Plejdkmm.exe
        17⤵
        
        PID:2832
        
        C:\Windows\SysWOW64\Pabblb32.exe
        
        C:\Windows\system32\Pabblb32.exe
        18⤵
        
        PID:828
        
        C:\Windows\SysWOW64\Piijno32.exe
        
        C:\Windows\system32\Piijno32.exe
        19⤵
        
        PID:3436
        
        C:\Windows\SysWOW64\Qhlkilba.exe
        
        C:\Windows\system32\Qhlkilba.exe
        20⤵
        
        PID:436
        
        C:\Windows\SysWOW64\Qadoba32.exe
        
        C:\Windows\system32\Qadoba32.exe
        21⤵
        
        PID:2792
        
        C:\Windows\SysWOW64\Qhngolpo.exe
        
        C:\Windows\system32\Qhngolpo.exe
        22⤵
        
        PID:3748
        
        C:\Windows\SysWOW64\Qljcoj32.exe
        
        C:\Windows\system32\Qljcoj32.exe
        23⤵
        
        PID:2104
        
        C:\Windows\SysWOW64\Qaflgago.exe
        
        C:\Windows\system32\Qaflgago.exe
        24⤵
        
        PID:3900
        
        C:\Windows\SysWOW64\Akoqpg32.exe
        
        C:\Windows\system32\Akoqpg32.exe
        25⤵
        
        PID:4052
        
        C:\Windows\SysWOW64\Acfhad32.exe
        
        C:\Windows\system32\Acfhad32.exe
        26⤵
        
        PID:4620
        
        C:\Windows\SysWOW64\Aeddnp32.exe
        
        C:\Windows\system32\Aeddnp32.exe
        27⤵
        
        PID:4416
        
        C:\Windows\SysWOW64\Alnmjjdb.exe
        
        C:\Windows\system32\Alnmjjdb.exe
        28⤵
        
        PID:4316
        
        C:\Windows\SysWOW64\Achegd32.exe
        
        C:\Windows\system32\Achegd32.exe
        29⤵
        
        PID:2848
        
        C:\Windows\SysWOW64\Afgacokc.exe
        
        C:\Windows\system32\Afgacokc.exe
        30⤵
        
        PID:3500
        
        C:\Windows\SysWOW64\Akcjkfij.exe
        
        C:\Windows\system32\Akcjkfij.exe
        31⤵
        
        PID:1576
        
        C:\Windows\SysWOW64\Aanbhp32.exe
        
        C:\Windows\system32\Aanbhp32.exe
        32⤵
        
        PID:4260
        
        C:\Windows\SysWOW64\Ajdjin32.exe
        
        C:\Windows\system32\Ajdjin32.exe
        33⤵
        
        PID:3652
        
        C:\Windows\SysWOW64\Alcfei32.exe
        
        C:\Windows\system32\Alcfei32.exe
        34⤵
        
        PID:1988
        
        C:\Windows\SysWOW64\Abponp32.exe
        
        C:\Windows\system32\Abponp32.exe
        35⤵
        
        PID:3032
        
        C:\Windows\SysWOW64\Afkknogn.exe
        
        C:\Windows\system32\Afkknogn.exe
        36⤵
        
        PID:1864
        
        C:\Windows\SysWOW64\Akhcfe32.exe
        
        C:\Windows\system32\Akhcfe32.exe
        37⤵
        
        PID:4548
        
        C:\Windows\SysWOW64\Abbkcpma.exe
        
        C:\Windows\system32\Abbkcpma.exe
        38⤵
        
        PID:3992
        
        C:\Windows\SysWOW64\Bhldpj32.exe
        
        C:\Windows\system32\Bhldpj32.exe
        39⤵
        
        PID:5148
        
        C:\Windows\SysWOW64\Bfpdin32.exe
        
        C:\Windows\system32\Bfpdin32.exe
        40⤵
        
        PID:5248
        
        C:\Windows\SysWOW64\Bfbaonae.exe
        
        C:\Windows\system32\Bfbaonae.exe
        41⤵
        
        PID:5328
        
        C:\Windows\SysWOW64\Bbiado32.exe
        
        C:\Windows\system32\Bbiado32.exe
        42⤵
        
        PID:5500
        
        C:\Windows\SysWOW64\Bombmcec.exe
        
        C:\Windows\system32\Bombmcec.exe
        43⤵
        
        PID:5676
  - - C:\Users\Admin\Downloads\240919-vk9s4szgnkebcc86bf3bd43460d200b9ce1f492e03_JaffaCakes118.exe
      C:\Users\Admin\Downloads\240919-vk9s4szgnkebcc86bf3bd43460d200b9ce1f492e03_JaffaCakes118.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2076
  - - C:\Users\Admin\Downloads\240919-vgsqeszfjjbac3afaa16edd67de3a2363aedff35df5c07fee448a473323847df2757bc9624N.exe
      C:\Users\Admin\Downloads\240919-vgsqeszfjjbac3afaa16edd67de3a2363aedff35df5c07fee448a473323847df2757bc9624N.exe
      4⤵
      PID:3212
  - - C:\Users\Admin\Downloads\240919-t5c47syhqlebc021ea94e1fe5a1767f3523f674983_JaffaCakes118.exe
      C:\Users\Admin\Downloads\240919-t5c47syhqlebc021ea94e1fe5a1767f3523f674983_JaffaCakes118.exe
      4⤵
      PID:3304
    - - C:\Windows\SysWOW64\net.exe
        
        net stop cryptsvc
        5⤵
        
        PID:1404
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop cryptsvc
        6⤵
        
        PID:600
    - - C:\Windows\SysWOW64\sc.exe
        
        sc config cryptsvc start= disabled
        5⤵
        Launches sc.exe
        
        PID:1884
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete cryptsvc
        5⤵
        Launches sc.exe
        
        PID:1876
  - - C:\Users\Admin\Downloads\240919-t2kd4sygmnebbe29d74e03003ffaaadc4edf11d6da_JaffaCakes118.exe
      C:\Users\Admin\Downloads\240919-t2kd4sygmnebbe29d74e03003ffaaadc4edf11d6da_JaffaCakes118.exe
      4⤵
      PID:5028
  - - C:\Users\Admin\Downloads\240919-vnc9bazhnm93a56afa540b8ecf8c6a307e5d71397d4fc730478fa9cf65489c5b9399319433N.exe
      C:\Users\Admin\Downloads\240919-vnc9bazhnm93a56afa540b8ecf8c6a307e5d71397d4fc730478fa9cf65489c5b9399319433N.exe
      4⤵
      PID:824
  - - C:\Users\Admin\Downloads\240919-vj6p3azfrr931984d92393324bbf0b8e1c639e0fdffcf4b380942e2969872b9c5033e207a6N.exe
      C:\Users\Admin\Downloads\240919-vj6p3azfrr931984d92393324bbf0b8e1c639e0fdffcf4b380942e2969872b9c5033e207a6N.exe
      4⤵
      PID:5288
    - - C:\Windows\SysWOW64\Bjnmpl32.exe
        
        C:\Windows\system32\Bjnmpl32.exe
        5⤵
        
        PID:5396
      - C:\Windows\SysWOW64\Bcfahbpo.exe
        
        C:\Windows\system32\Bcfahbpo.exe
        6⤵
        
        PID:5444
        
        C:\Windows\SysWOW64\Bfendmoc.exe
        
        C:\Windows\system32\Bfendmoc.exe
        7⤵
        
        PID:5536
        
        C:\Windows\SysWOW64\Bkafmd32.exe
        
        C:\Windows\system32\Bkafmd32.exe
        8⤵
        
        PID:5616
        
        C:\Windows\SysWOW64\Cfldelik.exe
        
        C:\Windows\system32\Cfldelik.exe
        9⤵
        
        PID:6012
        
        C:\Windows\SysWOW64\Cbbdjm32.exe
        
        C:\Windows\system32\Cbbdjm32.exe
        10⤵
        
        PID:5156
        
        C:\Windows\SysWOW64\Cofecami.exe
        
        C:\Windows\system32\Cofecami.exe
        11⤵
        
        PID:5336
        
        C:\Windows\SysWOW64\Ckmehb32.exe
        
        C:\Windows\system32\Ckmehb32.exe
        12⤵
        
        PID:5648
        
        C:\Windows\SysWOW64\Cjnffjkl.exe
        
        C:\Windows\system32\Cjnffjkl.exe
        13⤵
        
        PID:5800
  - - C:\Users\Admin\Downloads\240919-vlswzszcqe64918dfacc11cad87abfe9b80cfe6dd73f1d0299ea8bc3b64ab8ed6e1a6a9269N.exe
      C:\Users\Admin\Downloads\240919-vlswzszcqe64918dfacc11cad87abfe9b80cfe6dd73f1d0299ea8bc3b64ab8ed6e1a6a9269N.exe
      4⤵
      PID:5296
  - - C:\Users\Admin\Downloads\240919-vevr1azakb9f4b1eef764db662b718856deb62e380dd03d3270bfcac2611087291633b9f6bN.exe
      C:\Users\Admin\Downloads\240919-vevr1azakb9f4b1eef764db662b718856deb62e380dd03d3270bfcac2611087291633b9f6bN.exe
      4⤵
      PID:5556
    - - C:\Windows\SysWOW64\Bombmcec.exe
        
        C:\Windows\system32\Bombmcec.exe
        5⤵
        
        PID:5668
      - C:\Windows\SysWOW64\Bopocbcq.exe
        
        C:\Windows\system32\Bopocbcq.exe
        6⤵
        
        PID:5844
        
        C:\Windows\SysWOW64\Cjecpkcg.exe
        
        C:\Windows\system32\Cjecpkcg.exe
        7⤵
        
        PID:5896
        
        C:\Windows\SysWOW64\Cmflbf32.exe
        
        C:\Windows\system32\Cmflbf32.exe
        8⤵
        
        PID:6080
        
        C:\Windows\SysWOW64\Cjjlkk32.exe
        
        C:\Windows\system32\Cjjlkk32.exe
        9⤵
        
        PID:3644
        
        C:\Windows\SysWOW64\Cbeapmll.exe
        
        C:\Windows\system32\Cbeapmll.exe
        10⤵
        
        PID:5376
        
        C:\Windows\SysWOW64\Ccdnjp32.exe
        
        C:\Windows\system32\Ccdnjp32.exe
        11⤵
        
        PID:5708
        
        C:\Windows\SysWOW64\Ckpbnb32.exe
        
        C:\Windows\system32\Ckpbnb32.exe
        12⤵
        
        PID:5888
        
        C:\Windows\SysWOW64\Dbjkkl32.exe
        
        C:\Windows\system32\Dbjkkl32.exe
        13⤵
        
        PID:6020
  - - C:\Users\Admin\Downloads\240919-t9kd3szbqp801d1584cc0ac555e63ea9a0d74b5dd74c2a0c8e92109a4f23bb64690a12e1acN.exe
      C:\Users\Admin\Downloads\240919-t9kd3szbqp801d1584cc0ac555e63ea9a0d74b5dd74c2a0c8e92109a4f23bb64690a12e1acN.exe
      4⤵
      PID:5624
    - - C:\Windows\SysWOW64\Bkdcbd32.exe
        
        C:\Windows\system32\Bkdcbd32.exe
        5⤵
        
        PID:5772
      - C:\Windows\SysWOW64\Cihclh32.exe
        
        C:\Windows\system32\Cihclh32.exe
        6⤵
        
        PID:5936
        
        C:\Windows\SysWOW64\Ckilmcgb.exe
        
        C:\Windows\system32\Ckilmcgb.exe
        7⤵
        
        PID:6112
        
        C:\Windows\SysWOW64\Cimmggfl.exe
        
        C:\Windows\system32\Cimmggfl.exe
        8⤵
        
        PID:5268
        
        C:\Windows\SysWOW64\Cfqmpl32.exe
        
        C:\Windows\system32\Cfqmpl32.exe
        9⤵
        
        PID:5436
        
        C:\Windows\SysWOW64\Dfjpfj32.exe
        
        C:\Windows\system32\Dfjpfj32.exe
        10⤵
        
        PID:5432
        
        C:\Windows\SysWOW64\Dlghoa32.exe
        
        C:\Windows\system32\Dlghoa32.exe
        11⤵
        
        PID:4528
  - - C:\Users\Admin\Downloads\240919-vl9vhazhjp053b148abb83b29b9f0f6618ae0c3eefc79cf910d691ce191a2945c3763ce429N.exe
      C:\Users\Admin\Downloads\240919-vl9vhazhjp053b148abb83b29b9f0f6618ae0c3eefc79cf910d691ce191a2945c3763ce429N.exe
      4⤵
      PID:5736
    - - C:\backup.exe
        
        \backup.exe \
        5⤵
        
        PID:3240
      - C:\PerfLogs\backup.exe
        
        C:\PerfLogs\backup.exe C:\PerfLogs\
        6⤵
        
        PID:6880
      - C:\Program Files\backup.exe
        
        "C:\Program Files\backup.exe" C:\Program Files\
        6⤵
        
        PID:7348
        
        C:\Program Files\7-Zip\backup.exe
        
        "C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\
        7⤵
        
        PID:9296
  - - C:\Users\Admin\Downloads\240919-vggm6azaqg02ac651c2ba6ea6f9cee196555a79262c912d2af67d4b5db117cdf31bc788bc6N.exe
      C:\Users\Admin\Downloads\240919-vggm6azaqg02ac651c2ba6ea6f9cee196555a79262c912d2af67d4b5db117cdf31bc788bc6N.exe
      4⤵
      PID:5680
    - - C:\Windows\SysWOW64\Djqblj32.exe
        
        C:\Windows\system32\Djqblj32.exe
        5⤵
        
        PID:5280
      - C:\Windows\SysWOW64\Dcigeooj.exe
        
        C:\Windows\system32\Dcigeooj.exe
        6⤵
        
        PID:6120
        
        C:\Windows\SysWOW64\Dckdjomg.exe
        
        C:\Windows\system32\Dckdjomg.exe
        7⤵
        
        PID:6104
        
        C:\Windows\SysWOW64\Dmdhcddh.exe
        
        C:\Windows\system32\Dmdhcddh.exe
        8⤵
        
        PID:5264
        
        C:\Windows\SysWOW64\Dbqqkkbo.exe
        
        C:\Windows\system32\Dbqqkkbo.exe
        9⤵
        
        PID:5456
        
        C:\Windows\SysWOW64\Dpdaepai.exe
        
        C:\Windows\system32\Dpdaepai.exe
        10⤵
        
        PID:5996
        
        C:\Windows\SysWOW64\Dfoiaj32.exe
        
        C:\Windows\system32\Dfoiaj32.exe
        11⤵
        
        PID:5328
        
        C:\Windows\SysWOW64\Ejlbhh32.exe
        
        C:\Windows\system32\Ejlbhh32.exe
        12⤵
        
        PID:6064
        
        C:\Windows\SysWOW64\Eiaoid32.exe
        
        C:\Windows\system32\Eiaoid32.exe
        13⤵
        
        PID:5316
        
        C:\Windows\SysWOW64\Elbhjp32.exe
        
        C:\Windows\system32\Elbhjp32.exe
        14⤵
        
        PID:4508
        
        C:\Windows\SysWOW64\Ejchhgid.exe
        
        C:\Windows\system32\Ejchhgid.exe
        15⤵
        
        PID:4316
        
        C:\Windows\SysWOW64\Ejfeng32.exe
        
        C:\Windows\system32\Ejfeng32.exe
        16⤵
        
        PID:6060
        
        C:\Windows\SysWOW64\Fbajbi32.exe
        
        C:\Windows\system32\Fbajbi32.exe
        17⤵
        
        PID:5836
        
        C:\Windows\SysWOW64\Flinkojm.exe
        
        C:\Windows\system32\Flinkojm.exe
        18⤵
        
        PID:5320
        
        C:\Windows\SysWOW64\Fllkqn32.exe
        
        C:\Windows\system32\Fllkqn32.exe
        19⤵
        
        PID:4720
        
        C:\Windows\SysWOW64\Fdepgkgj.exe
        
        C:\Windows\system32\Fdepgkgj.exe
        20⤵
        
        PID:5376
        
        C:\Windows\SysWOW64\Fjadje32.exe
        
        C:\Windows\system32\Fjadje32.exe
        21⤵
        
        PID:5260
        
        C:\Windows\SysWOW64\Gjdaodja.exe
        
        C:\Windows\system32\Gjdaodja.exe
        22⤵
        
        PID:6032
        
        C:\Windows\SysWOW64\Giinpa32.exe
        
        C:\Windows\system32\Giinpa32.exe
        23⤵
        
        PID:5504
        
        C:\Windows\SysWOW64\Hpofii32.exe
        
        C:\Windows\system32\Hpofii32.exe
        24⤵
        
        PID:6456
        
        C:\Windows\SysWOW64\Ilafiihp.exe
        
        C:\Windows\system32\Ilafiihp.exe
        25⤵
        
        PID:212
        
        C:\Windows\SysWOW64\Knfeeimj.exe
        
        C:\Windows\system32\Knfeeimj.exe
        26⤵
        
        PID:8176
        
        C:\Windows\SysWOW64\Maiccajf.exe
        
        C:\Windows\system32\Maiccajf.exe
        27⤵
        
        PID:7872
        
        C:\Windows\SysWOW64\Oanfen32.exe
        
        C:\Windows\system32\Oanfen32.exe
        28⤵
        
        PID:10536
  - - C:\Users\Admin\Downloads\240919-vnfpfazdqc70521464aa326fe80c5f6d4ec506aa1f26e775a49a3644457745212f2ff6d2ad.exe
      C:\Users\Admin\Downloads\240919-vnfpfazdqc70521464aa326fe80c5f6d4ec506aa1f26e775a49a3644457745212f2ff6d2ad.exe
      4⤵
      PID:5924
  - - C:\Users\Admin\Downloads\240919-t8n1wazbmj5d19b74c09235548726d2187a83bf6630bb370d07cb1b3765d93474e873d86f5N.exe
      C:\Users\Admin\Downloads\240919-t8n1wazbmj5d19b74c09235548726d2187a83bf6630bb370d07cb1b3765d93474e873d86f5N.exe
      4⤵
      PID:3992
  - - C:\Users\Admin\Downloads\240919-vecleszdrqe12c127497254dc73253a6fc8cb02eb2b34f7cc0897677f0dd87b513b326c956N.exe
      C:\Users\Admin\Downloads\240919-vecleszdrqe12c127497254dc73253a6fc8cb02eb2b34f7cc0897677f0dd87b513b326c956N.exe
      4⤵
      PID:5080
    - - C:\Windows\SysWOW64\Dcnqpo32.exe
        
        C:\Windows\system32\Dcnqpo32.exe
        5⤵
        
        PID:5700
      - C:\Windows\SysWOW64\Dlkbjqgm.exe
        
        C:\Windows\system32\Dlkbjqgm.exe
        6⤵
        
        PID:2700
        
        C:\Windows\SysWOW64\Elpkep32.exe
        
        C:\Windows\system32\Elpkep32.exe
        7⤵
        
        PID:5852
        
        C:\Windows\SysWOW64\Epndknin.exe
        
        C:\Windows\system32\Epndknin.exe
        8⤵
        
        PID:1988
        
        C:\Windows\SysWOW64\Eppqqn32.exe
        
        C:\Windows\system32\Eppqqn32.exe
        9⤵
        
        PID:5488
        
        C:\Windows\SysWOW64\Efjimhnh.exe
        
        C:\Windows\system32\Efjimhnh.exe
        10⤵
        
        PID:4636
        
        C:\Windows\SysWOW64\Fbcfhibj.exe
        
        C:\Windows\system32\Fbcfhibj.exe
        11⤵
        
        PID:5776
        
        C:\Windows\SysWOW64\Fbfcmhpg.exe
        
        C:\Windows\system32\Fbfcmhpg.exe
        12⤵
        
        PID:5668
        
        C:\Windows\SysWOW64\Fdglmkeg.exe
        
        C:\Windows\system32\Fdglmkeg.exe
        13⤵
        
        PID:6040
        
        C:\Windows\SysWOW64\Gdjibj32.exe
        
        C:\Windows\system32\Gdjibj32.exe
        14⤵
        
        PID:5288
        
        C:\Windows\SysWOW64\Gpecbk32.exe
        
        C:\Windows\system32\Gpecbk32.exe
        15⤵
        
        PID:5984
        
        C:\Windows\SysWOW64\Hmnmgnoh.exe
        
        C:\Windows\system32\Hmnmgnoh.exe
        16⤵
        
        PID:5364
        
        C:\Windows\SysWOW64\Hiiggoaf.exe
        
        C:\Windows\system32\Hiiggoaf.exe
        17⤵
        
        PID:6812
        
        C:\Windows\SysWOW64\Jddnfd32.exe
        
        C:\Windows\system32\Jddnfd32.exe
        18⤵
        
        PID:7252
        
        C:\Windows\SysWOW64\Lklbdm32.exe
        
        C:\Windows\system32\Lklbdm32.exe
        19⤵
        
        PID:8304
        
        C:\Windows\SysWOW64\Njfagf32.exe
        
        C:\Windows\system32\Njfagf32.exe
        20⤵
        
        PID:9660
  - - C:\Users\Admin\Downloads\240919-vhp1xszfmkccf3ce12f4536a6c7f818c8800ccb334f859ce737d2d7e12af1a3b34c3aca81cN.exe
      C:\Users\Admin\Downloads\240919-vhp1xszfmkccf3ce12f4536a6c7f818c8800ccb334f859ce737d2d7e12af1a3b34c3aca81cN.exe
      4⤵
      PID:5544
    - - \??\c:\4004440.exe
        
        c:\4004440.exe
        5⤵
        
        PID:5884
      - \??\c:\480408.exe
        
        c:\480408.exe
        6⤵
        
        PID:5600
        
        \??\c:\6848666.exe
        
        c:\6848666.exe
        7⤵
        
        PID:5364
        
        \??\c:\00826.exe
        
        c:\00826.exe
        8⤵
        
        PID:5604
        
        \??\c:\46260.exe
        
        c:\46260.exe
        9⤵
        
        PID:5252
        
        \??\c:\80600.exe
        
        c:\80600.exe
        10⤵
        
        PID:5408
        
        \??\c:\484404.exe
        
        c:\484404.exe
        11⤵
        
        PID:1416
        
        \??\c:\04484.exe
        
        c:\04484.exe
        12⤵
        
        PID:5356
        
        \??\c:\86886.exe
        
        c:\86886.exe
        13⤵
        
        PID:1744
        
        \??\c:\4248266.exe
        
        c:\4248266.exe
        14⤵
        
        PID:2120
        
        \??\c:\22246.exe
        
        c:\22246.exe
        15⤵
        
        PID:6288
        
        \??\c:\0426066.exe
        
        c:\0426066.exe
        16⤵
        
        PID:6968
        
        \??\c:\086664.exe
        
        c:\086664.exe
        17⤵
        
        PID:3276
        
        \??\c:\64820.exe
        
        c:\64820.exe
        18⤵
        
        PID:4828
        
        \??\c:\68284.exe
        
        c:\68284.exe
        19⤵
        
        PID:8652
        
        \??\c:\6404440.exe
        
        c:\6404440.exe
        20⤵
        
        PID:7412
        
        \??\c:\g0622.exe
        
        c:\g0622.exe
        21⤵
        
        PID:10836
        
        \??\c:\662604.exe
        
        c:\662604.exe
        22⤵
        
        PID:12000
        
        \??\c:\4028404.exe
        
        c:\4028404.exe
        23⤵
        
        PID:10692
        
        \??\c:\080404.exe
        
        c:\080404.exe
        24⤵
        
        PID:7728
        
        \??\c:\82608.exe
        
        c:\82608.exe
        25⤵
        
        PID:15844
  - - C:\Users\Admin\Downloads\240919-vmf9kszhkmebcd6a93174e8aa399590afc28dca364_JaffaCakes118.exe
      C:\Users\Admin\Downloads\240919-vmf9kszhkmebcd6a93174e8aa399590afc28dca364_JaffaCakes118.exe
      4⤵
      PID:5548
  - - C:\Users\Admin\Downloads\240919-ve41nszalbebc8777a9ed70d5b622526594cda434a_JaffaCakes118.exe
      C:\Users\Admin\Downloads\240919-ve41nszalbebc8777a9ed70d5b622526594cda434a_JaffaCakes118.exe
      4⤵
      PID:5124
    - - C:\Windows\SysWOW64\msdtcprx\mscat32.exe
        
        "C:\Windows\SysWOW64\msdtcprx\mscat32.exe"
        5⤵
        
        PID:3644
  - - C:\Users\Admin\Downloads\240919-t8rrrsyfmfebc2df3aafc5a3211196a5ea739b397a_JaffaCakes118.exe
      C:\Users\Admin\Downloads\240919-t8rrrsyfmfebc2df3aafc5a3211196a5ea739b397a_JaffaCakes118.exe
      4⤵
      PID:5476
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5476 -s 356
        5⤵
        Program crash
        
        PID:6128
  - - C:\Users\Admin\Downloads\240919-vc629azdmjebc67862059d247cc2258510cdf3fea4_JaffaCakes118.exe
      C:\Users\Admin\Downloads\240919-vc629azdmjebc67862059d247cc2258510cdf3fea4_JaffaCakes118.exe
      4⤵
      PID:5760
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5760 -s 540
        5⤵
        Program crash
        
        PID:5884
  - - C:\Users\Admin\Downloads\240919-vjwvvszfqr039f29698e42f307e9620bb4e6b53238b68d2f86f83ac2db98ab47cb68611317N.exe
      C:\Users\Admin\Downloads\240919-vjwvvszfqr039f29698e42f307e9620bb4e6b53238b68d2f86f83ac2db98ab47cb68611317N.exe
      4⤵
      PID:5232
    - - C:\Windows\SysWOW64\Eleepoob.exe
        
        C:\Windows\system32\Eleepoob.exe
        5⤵
        
        PID:5140
      - C:\Windows\SysWOW64\Fdqfll32.exe
        
        C:\Windows\system32\Fdqfll32.exe
        6⤵
        
        PID:5908
        
        C:\Windows\SysWOW64\Ffaong32.exe
        
        C:\Windows\system32\Ffaong32.exe
        7⤵
        
        PID:5624
        
        C:\Windows\SysWOW64\Fdglmkeg.exe
        
        C:\Windows\system32\Fdglmkeg.exe
        8⤵
        
        PID:5876
        
        C:\Windows\SysWOW64\Gfheof32.exe
        
        C:\Windows\system32\Gfheof32.exe
        9⤵
        
        PID:6088
        
        C:\Windows\SysWOW64\Gfkbde32.exe
        
        C:\Windows\system32\Gfkbde32.exe
        10⤵
        
        PID:5724
        
        C:\Windows\SysWOW64\Hienlpel.exe
        
        C:\Windows\system32\Hienlpel.exe
        11⤵
        
        PID:6312
        
        C:\Windows\SysWOW64\Iknmla32.exe
        
        C:\Windows\system32\Iknmla32.exe
        12⤵
        
        PID:4980
        
        C:\Windows\SysWOW64\Jpaleglc.exe
        
        C:\Windows\system32\Jpaleglc.exe
        13⤵
        
        PID:6660
        
        C:\Windows\SysWOW64\Kjepjkhf.exe
        
        C:\Windows\system32\Kjepjkhf.exe
        14⤵
        
        PID:7708
        
        C:\Windows\SysWOW64\Lqbncb32.exe
        
        C:\Windows\system32\Lqbncb32.exe
        15⤵
        
        PID:8952
  - - C:\Users\Admin\Downloads\240919-vjr7nszbrf9935456671da174c1dacdbb123ea98240cee3ad68278ec4275fbd278964f78daN.exe
      C:\Users\Admin\Downloads\240919-vjr7nszbrf9935456671da174c1dacdbb123ea98240cee3ad68278ec4275fbd278964f78daN.exe
      4⤵
      PID:5992
    - - C:\Windows\SysWOW64\Fjhacf32.exe
        
        C:\Windows\system32\Fjhacf32.exe
        5⤵
        
        PID:5568
      - C:\Windows\SysWOW64\Fbfcmhpg.exe
        
        C:\Windows\system32\Fbfcmhpg.exe
        6⤵
        
        PID:5148
        
        C:\Windows\SysWOW64\Fplpll32.exe
        
        C:\Windows\system32\Fplpll32.exe
        7⤵
        
        PID:2424
        
        C:\Windows\SysWOW64\Gdjibj32.exe
        
        C:\Windows\system32\Gdjibj32.exe
        8⤵
        
        PID:5400
        
        C:\Windows\SysWOW64\Gdlfhj32.exe
        
        C:\Windows\system32\Gdlfhj32.exe
        9⤵
        
        PID:2304
        
        C:\Windows\SysWOW64\Gkkgpc32.exe
        
        C:\Windows\system32\Gkkgpc32.exe
        10⤵
        
        PID:5912
        
        C:\Windows\SysWOW64\Hlcjhkdp.exe
        
        C:\Windows\system32\Hlcjhkdp.exe
        11⤵
        
        PID:6396
        
        C:\Windows\SysWOW64\Hkicaahi.exe
        
        C:\Windows\system32\Hkicaahi.exe
        12⤵
        
        PID:7012
        
        C:\Windows\SysWOW64\Ikpjbq32.exe
        
        C:\Windows\system32\Ikpjbq32.exe
        13⤵
        
        PID:6280
        
        C:\Windows\SysWOW64\Jkimho32.exe
        
        C:\Windows\system32\Jkimho32.exe
        14⤵
        
        PID:6492
        
        C:\Windows\SysWOW64\Kdmqmc32.exe
        
        C:\Windows\system32\Kdmqmc32.exe
        15⤵
        
        PID:8044
        
        C:\Windows\SysWOW64\Lqkgbcff.exe
        
        C:\Windows\system32\Lqkgbcff.exe
        16⤵
        
        PID:8804
        
        C:\Windows\SysWOW64\Plkpcfal.exe
        
        C:\Windows\system32\Plkpcfal.exe
        17⤵
        
        PID:14060
  - - C:\Users\Admin\Downloads\240919-vjnjgszfpp7409743b80d4ea8661d0975beba77e352dddc0ed646134574c88207c3ec6593fN.exe
      C:\Users\Admin\Downloads\240919-vjnjgszfpp7409743b80d4ea8661d0975beba77e352dddc0ed646134574c88207c3ec6593fN.exe
      4⤵
      PID:5848
    - - C:\Windows\SysWOW64\Fdccbl32.exe
        
        C:\Windows\system32\Fdccbl32.exe
        5⤵
        
        PID:4664
      - C:\Windows\SysWOW64\Glcaambb.exe
        
        C:\Windows\system32\Glcaambb.exe
        6⤵
        
        PID:5684
        
        C:\Windows\SysWOW64\Gmbmkpie.exe
        
        C:\Windows\system32\Gmbmkpie.exe
        7⤵
        
        PID:3224
        
        C:\Windows\SysWOW64\Gbdoof32.exe
        
        C:\Windows\system32\Gbdoof32.exe
        8⤵
        
        PID:2128
        
        C:\Windows\SysWOW64\Hloqml32.exe
        
        C:\Windows\system32\Hloqml32.exe
        9⤵
        
        PID:1788
        
        C:\Windows\SysWOW64\Hckeoeno.exe
        
        C:\Windows\system32\Hckeoeno.exe
        10⤵
        
        PID:6188
        
        C:\Windows\SysWOW64\Hdokdg32.exe
        
        C:\Windows\system32\Hdokdg32.exe
        11⤵
        
        PID:6924
        
        C:\Windows\SysWOW64\Jncoikmp.exe
        
        C:\Windows\system32\Jncoikmp.exe
        12⤵
        
        PID:6464
        
        C:\Windows\SysWOW64\Kclgmq32.exe
        
        C:\Windows\system32\Kclgmq32.exe
        13⤵
        
        PID:7596
        
        C:\Windows\SysWOW64\Lmdemd32.exe
        
        C:\Windows\system32\Lmdemd32.exe
        14⤵
        
        PID:8812
        
        C:\Windows\SysWOW64\Njpdnedf.exe
        
        C:\Windows\system32\Njpdnedf.exe
        15⤵
        
        PID:10312
  - - C:\Users\Admin\Downloads\240919-vb7mdsyhjfe565daa060717278591c544a231000a8ebc6b3bb67171875b896debf02f6136bN.exe
      C:\Users\Admin\Downloads\240919-vb7mdsyhjfe565daa060717278591c544a231000a8ebc6b3bb67171875b896debf02f6136bN.exe
      4⤵
      PID:5576
  - - C:\Users\Admin\Downloads\240919-vg2y4azfkkebca36ababa9d4991d30306df4a8f75e_JaffaCakes118.exe
      C:\Users\Admin\Downloads\240919-vg2y4azfkkebca36ababa9d4991d30306df4a8f75e_JaffaCakes118.exe
      4⤵
      PID:5644
    - - C:\Users\Admin\d3s3Jf2gX6.exe
        
        C:\Users\Admin\d3s3Jf2gX6.exe
        5⤵
        
        PID:5240
  - - C:\Users\Admin\Downloads\240919-vaaw2ayglaebc41e6a7ed12d93fe7bdfb9bed33975_JaffaCakes118.exe
      C:\Users\Admin\Downloads\240919-vaaw2ayglaebc41e6a7ed12d93fe7bdfb9bed33975_JaffaCakes118.exe
      4⤵
      PID:5716
  - - C:\Users\Admin\Downloads\240919-vkl22szcldebcbf9f0e55f34eda4f2e9489979b648_JaffaCakes118.exe
      C:\Users\Admin\Downloads\240919-vkl22szcldebcbf9f0e55f34eda4f2e9489979b648_JaffaCakes118.exe
      4⤵
      PID:6012
  - - C:\Users\Admin\Downloads\240919-vhvamszfmn958c54eb0213071dabcbb4f9ac743ef156ebbd22b368bc122ead8c890a973c5bN.exe
      C:\Users\Admin\Downloads\240919-vhvamszfmn958c54eb0213071dabcbb4f9ac743ef156ebbd22b368bc122ead8c890a973c5bN.exe
      4⤵
      PID:2068
    - - C:\Windows\System32\muhxqOJ.exe
        
        C:\Windows\System32\muhxqOJ.exe
        5⤵
        
        PID:5940
    - - C:\Windows\System32\ApDsLdT.exe
        
        C:\Windows\System32\ApDsLdT.exe
        5⤵
        
        PID:6140
    - - C:\Windows\System32\yiwlrVO.exe
        
        C:\Windows\System32\yiwlrVO.exe
        5⤵
        
        PID:5236
    - - C:\Windows\System32\KXPEZht.exe
        
        C:\Windows\System32\KXPEZht.exe
        5⤵
        
        PID:6016
    - - C:\Windows\System32\YEGGpDK.exe
        
        C:\Windows\System32\YEGGpDK.exe
        5⤵
        
        PID:6020
    - - C:\Windows\System32\ZDXGxWK.exe
        
        C:\Windows\System32\ZDXGxWK.exe
        5⤵
        
        PID:5304
    - - C:\Windows\System32\zgumbhu.exe
        
        C:\Windows\System32\zgumbhu.exe
        5⤵
        
        PID:5480
    - - C:\Windows\System32\FGqtWuw.exe
        
        C:\Windows\System32\FGqtWuw.exe
        5⤵
        
        PID:4584
    - - C:\Windows\System32\ckumrNR.exe
        
        C:\Windows\System32\ckumrNR.exe
        5⤵
        
        PID:664
    - - C:\Windows\System32\HUBjnaC.exe
        
        C:\Windows\System32\HUBjnaC.exe
        5⤵
        
        PID:5636
    - - C:\Windows\System32\LWRaesF.exe
        
        C:\Windows\System32\LWRaesF.exe
        5⤵
        
        PID:5128
    - - C:\Windows\System32\BhuhQXc.exe
        
        C:\Windows\System32\BhuhQXc.exe
        5⤵
        
        PID:5428
    - - C:\Windows\System32\Pbefnyo.exe
        
        C:\Windows\System32\Pbefnyo.exe
        5⤵
        
        PID:5784
    - - C:\Windows\System32\Hdckkjr.exe
        
        C:\Windows\System32\Hdckkjr.exe
        5⤵
        
        PID:6164
    - - C:\Windows\System32\ArbYTty.exe
        
        C:\Windows\System32\ArbYTty.exe
        5⤵
        
        PID:6208
    - - C:\Windows\System32\hNCtGVK.exe
        
        C:\Windows\System32\hNCtGVK.exe
        5⤵
        
        PID:6244
    - - C:\Windows\System32\MODMVOH.exe
        
        C:\Windows\System32\MODMVOH.exe
        5⤵
        
        PID:6264
    - - C:\Windows\System32\eLUMXxq.exe
        
        C:\Windows\System32\eLUMXxq.exe
        5⤵
        
        PID:6320
    - - C:\Windows\System32\sAefjnn.exe
        
        C:\Windows\System32\sAefjnn.exe
        5⤵
        
        PID:6344
    - - C:\Windows\System32\CfpCjJv.exe
        
        C:\Windows\System32\CfpCjJv.exe
        5⤵
        
        PID:6360
    - - C:\Windows\System32\MKueGyG.exe
        
        C:\Windows\System32\MKueGyG.exe
        5⤵
        
        PID:6404
    - - C:\Windows\System32\FfmXGvI.exe
        
        C:\Windows\System32\FfmXGvI.exe
        5⤵
        
        PID:6428
    - - C:\Windows\System32\gkimman.exe
        
        C:\Windows\System32\gkimman.exe
        5⤵
        
        PID:6496
    - - C:\Windows\System32\tvpneOG.exe
        
        C:\Windows\System32\tvpneOG.exe
        5⤵
        
        PID:6516
    - - C:\Windows\System32\puZQhLK.exe
        
        C:\Windows\System32\puZQhLK.exe
        5⤵
        
        PID:6532
    - - C:\Windows\System32\xsFSXEz.exe
        
        C:\Windows\System32\xsFSXEz.exe
        5⤵
        
        PID:6548
    - - C:\Windows\System32\NYHDgpz.exe
        
        C:\Windows\System32\NYHDgpz.exe
        5⤵
        
        PID:6568
    - - C:\Windows\System32\jHZbdvm.exe
        
        C:\Windows\System32\jHZbdvm.exe
        5⤵
        
        PID:6584
    - - C:\Windows\System32\xvCRMKj.exe
        
        C:\Windows\System32\xvCRMKj.exe
        5⤵
        
        PID:6600
    - - C:\Windows\System32\wCrrmuj.exe
        
        C:\Windows\System32\wCrrmuj.exe
        5⤵
        
        PID:6616
    - - C:\Windows\System32\aOGOnFs.exe
        
        C:\Windows\System32\aOGOnFs.exe
        5⤵
        
        PID:6636
    - - C:\Windows\System32\RHayBEf.exe
        
        C:\Windows\System32\RHayBEf.exe
        5⤵
        
        PID:6652
    - - C:\Windows\System32\WNJbxcb.exe
        
        C:\Windows\System32\WNJbxcb.exe
        5⤵
        
        PID:6676
    - - C:\Windows\System32\vLvPtkf.exe
        
        C:\Windows\System32\vLvPtkf.exe
        5⤵
        
        PID:6700
    - - C:\Windows\System32\anwHHTV.exe
        
        C:\Windows\System32\anwHHTV.exe
        5⤵
        
        PID:6724
    - - C:\Windows\System32\iaRPVnN.exe
        
        C:\Windows\System32\iaRPVnN.exe
        5⤵
        
        PID:6740
    - - C:\Windows\System32\ccjWhls.exe
        
        C:\Windows\System32\ccjWhls.exe
        5⤵
        
        PID:6764
    - - C:\Windows\System32\EAnjZsC.exe
        
        C:\Windows\System32\EAnjZsC.exe
        5⤵
        
        PID:6788
    - - C:\Windows\System32\ZMPkbev.exe
        
        C:\Windows\System32\ZMPkbev.exe
        5⤵
        
        PID:6836
    - - C:\Windows\System32\cefExcw.exe
        
        C:\Windows\System32\cefExcw.exe
        5⤵
        
        PID:6860
    - - C:\Windows\System32\eIYGste.exe
        
        C:\Windows\System32\eIYGste.exe
        5⤵
        
        PID:6888
    - - C:\Windows\System32\MFguYtk.exe
        
        C:\Windows\System32\MFguYtk.exe
        5⤵
        
        PID:3436
    - - C:\Windows\System32\CHrESlE.exe
        
        C:\Windows\System32\CHrESlE.exe
        5⤵
        
        PID:4844
    - - C:\Windows\System32\sbSVCRV.exe
        
        C:\Windows\System32\sbSVCRV.exe
        5⤵
        
        PID:1412
    - - C:\Windows\System32\FeqnDnd.exe
        
        C:\Windows\System32\FeqnDnd.exe
        5⤵
        
        PID:5396
    - - C:\Windows\System32\lsyIOxu.exe
        
        C:\Windows\System32\lsyIOxu.exe
        5⤵
        
        PID:5608
    - - C:\Windows\System32\DKkmbWX.exe
        
        C:\Windows\System32\DKkmbWX.exe
        5⤵
        
        PID:192
    - - C:\Windows\System32\MiGFyGU.exe
        
        C:\Windows\System32\MiGFyGU.exe
        5⤵
        
        PID:1884
    - - C:\Windows\System32\Reyblep.exe
        
        C:\Windows\System32\Reyblep.exe
        5⤵
        
        PID:5660
    - - C:\Windows\System32\uABwown.exe
        
        C:\Windows\System32\uABwown.exe
        5⤵
        
        PID:6004
    - - C:\Windows\System32\BxWQzLs.exe
        
        C:\Windows\System32\BxWQzLs.exe
        5⤵
        
        PID:6200
    - - C:\Windows\System32\lJHbMPz.exe
        
        C:\Windows\System32\lJHbMPz.exe
        5⤵
        
        PID:768
    - - C:\Windows\System32\YOmpiVF.exe
        
        C:\Windows\System32\YOmpiVF.exe
        5⤵
        
        PID:2984
    - - C:\Windows\System32\JpcRTUE.exe
        
        C:\Windows\System32\JpcRTUE.exe
        5⤵
        
        PID:2164
    - - C:\Windows\System32\QQHsXpz.exe
        
        C:\Windows\System32\QQHsXpz.exe
        5⤵
        
        PID:6528
    - - C:\Windows\System32\IyKggZQ.exe
        
        C:\Windows\System32\IyKggZQ.exe
        5⤵
        
        PID:6580
    - - C:\Windows\System32\TLMaFWw.exe
        
        C:\Windows\System32\TLMaFWw.exe
        5⤵
        
        PID:6612
    - - C:\Windows\System32\UACTiJc.exe
        
        C:\Windows\System32\UACTiJc.exe
        5⤵
        
        PID:6824
    - - C:\Windows\System32\OQbDjfp.exe
        
        C:\Windows\System32\OQbDjfp.exe
        5⤵
        
        PID:6932
    - - C:\Windows\System32\Ludpywd.exe
        
        C:\Windows\System32\Ludpywd.exe
        5⤵
        
        PID:7152
    - - C:\Windows\System32\yZmzPMQ.exe
        
        C:\Windows\System32\yZmzPMQ.exe
        5⤵
        
        PID:5748
    - - C:\Windows\System32\fgTedFm.exe
        
        C:\Windows\System32\fgTedFm.exe
        5⤵
        
        PID:1224
    - - C:\Windows\System32\WeaOTJE.exe
        
        C:\Windows\System32\WeaOTJE.exe
        5⤵
        
        PID:7008
    - - C:\Windows\System32\TsglMcQ.exe
        
        C:\Windows\System32\TsglMcQ.exe
        5⤵
        
        PID:7036
    - - C:\Windows\System32\dbikLst.exe
        
        C:\Windows\System32\dbikLst.exe
        5⤵
        
        PID:6708
    - - C:\Windows\System32\TAMxqha.exe
        
        C:\Windows\System32\TAMxqha.exe
        5⤵
        
        PID:7240
    - - C:\Windows\System32\gLchHor.exe
        
        C:\Windows\System32\gLchHor.exe
        5⤵
        
        PID:7272
    - - C:\Windows\System32\mcVlWEI.exe
        
        C:\Windows\System32\mcVlWEI.exe
        5⤵
        
        PID:7296
    - - C:\Windows\System32\hVSkRoP.exe
        
        C:\Windows\System32\hVSkRoP.exe
        5⤵
        
        PID:7312
    - - C:\Windows\System32\LIofTpT.exe
        
        C:\Windows\System32\LIofTpT.exe
        5⤵
        
        PID:7328
    - - C:\Windows\System32\buNIcdm.exe
        
        C:\Windows\System32\buNIcdm.exe
        5⤵
        
        PID:7356
    - - C:\Windows\System32\zPiNhXu.exe
        
        C:\Windows\System32\zPiNhXu.exe
        5⤵
        
        PID:7380
    - - C:\Windows\System32\xgxeIQf.exe
        
        C:\Windows\System32\xgxeIQf.exe
        5⤵
        
        PID:7396
    - - C:\Windows\System32\zsIiewF.exe
        
        C:\Windows\System32\zsIiewF.exe
        5⤵
        
        PID:7416
    - - C:\Windows\System32\itzhmXk.exe
        
        C:\Windows\System32\itzhmXk.exe
        5⤵
        
        PID:7432
    - - C:\Windows\System32\KiugpcN.exe
        
        C:\Windows\System32\KiugpcN.exe
        5⤵
        
        PID:7456
    - - C:\Windows\System32\MoaPmuw.exe
        
        C:\Windows\System32\MoaPmuw.exe
        5⤵
        
        PID:7472
    - - C:\Windows\System32\WnmpCWe.exe
        
        C:\Windows\System32\WnmpCWe.exe
        5⤵
        
        PID:7488
    - - C:\Windows\System32\YeyZHEl.exe
        
        C:\Windows\System32\YeyZHEl.exe
        5⤵
        
        PID:7516
    - - C:\Windows\System32\ZqbZvkh.exe
        
        C:\Windows\System32\ZqbZvkh.exe
        5⤵
        
        PID:7532
    - - C:\Windows\System32\LeTzAbM.exe
        
        C:\Windows\System32\LeTzAbM.exe
        5⤵
        
        PID:7552
    - - C:\Windows\System32\FerGcpx.exe
        
        C:\Windows\System32\FerGcpx.exe
        5⤵
        
        PID:7572
    - - C:\Windows\System32\eHFyWQF.exe
        
        C:\Windows\System32\eHFyWQF.exe
        5⤵
        
        PID:7620
    - - C:\Windows\System32\JWgZgCw.exe
        
        C:\Windows\System32\JWgZgCw.exe
        5⤵
        
        PID:7636
    - - C:\Windows\System32\jNShrij.exe
        
        C:\Windows\System32\jNShrij.exe
        5⤵
        
        PID:7656
    - - C:\Windows\System32\XbGArGS.exe
        
        C:\Windows\System32\XbGArGS.exe
        5⤵
        
        PID:7676
    - - C:\Windows\System32\drWaLLE.exe
        
        C:\Windows\System32\drWaLLE.exe
        5⤵
        
        PID:7716
    - - C:\Windows\System32\BMrIiTk.exe
        
        C:\Windows\System32\BMrIiTk.exe
        5⤵
        
        PID:7736
    - - C:\Windows\System32\YpHROCy.exe
        
        C:\Windows\System32\YpHROCy.exe
        5⤵
        
        PID:7756
    - - C:\Windows\System32\ZNnXxYv.exe
        
        C:\Windows\System32\ZNnXxYv.exe
        5⤵
        
        PID:7776
    - - C:\Windows\System32\rkcoHhr.exe
        
        C:\Windows\System32\rkcoHhr.exe
        5⤵
        
        PID:7792
    - - C:\Windows\System32\KIcIuJQ.exe
        
        C:\Windows\System32\KIcIuJQ.exe
        5⤵
        
        PID:7816
    - - C:\Windows\System32\McgeEXq.exe
        
        C:\Windows\System32\McgeEXq.exe
        5⤵
        
        PID:7836
    - - C:\Windows\System32\QoQogxg.exe
        
        C:\Windows\System32\QoQogxg.exe
        5⤵
        
        PID:7852
    - - C:\Windows\System32\eYIkFIg.exe
        
        C:\Windows\System32\eYIkFIg.exe
        5⤵
        
        PID:7876
    - - C:\Windows\System32\TmGueWc.exe
        
        C:\Windows\System32\TmGueWc.exe
        5⤵
        
        PID:7892
    - - C:\Windows\System32\EftgRTG.exe
        
        C:\Windows\System32\EftgRTG.exe
        5⤵
        
        PID:7916
    - - C:\Windows\System32\KEJAgaA.exe
        
        C:\Windows\System32\KEJAgaA.exe
        5⤵
        
        PID:7940
    - - C:\Windows\System32\ACZDHMH.exe
        
        C:\Windows\System32\ACZDHMH.exe
        5⤵
        
        PID:7956
    - - C:\Windows\System32\pAnKFjf.exe
        
        C:\Windows\System32\pAnKFjf.exe
        5⤵
        
        PID:7972
    - - C:\Windows\System32\mzJGAuF.exe
        
        C:\Windows\System32\mzJGAuF.exe
        5⤵
        
        PID:7988
    - - C:\Windows\System32\whciKdU.exe
        
        C:\Windows\System32\whciKdU.exe
        5⤵
        
        PID:8008
    - - C:\Windows\System32\qKArNWo.exe
        
        C:\Windows\System32\qKArNWo.exe
        5⤵
        
        PID:8052
    - - C:\Windows\System32\JFgUAHT.exe
        
        C:\Windows\System32\JFgUAHT.exe
        5⤵
        
        PID:8076
    - - C:\Windows\System32\cWcaPaJ.exe
        
        C:\Windows\System32\cWcaPaJ.exe
        5⤵
        
        PID:8092
    - - C:\Windows\System32\aMCauoi.exe
        
        C:\Windows\System32\aMCauoi.exe
        5⤵
        
        PID:8112
    - - C:\Windows\System32\qdrddsi.exe
        
        C:\Windows\System32\qdrddsi.exe
        5⤵
        
        PID:8132
    - - C:\Windows\System32\eqmNBVv.exe
        
        C:\Windows\System32\eqmNBVv.exe
        5⤵
        
        PID:8152
    - - C:\Windows\System32\JkbjTpC.exe
        
        C:\Windows\System32\JkbjTpC.exe
        5⤵
        
        PID:6256
    - - C:\Windows\System32\csEWuzn.exe
        
        C:\Windows\System32\csEWuzn.exe
        5⤵
        
        PID:1164
    - - C:\Windows\System32\aqXWLWu.exe
        
        C:\Windows\System32\aqXWLWu.exe
        5⤵
        
        PID:592
    - - C:\Windows\System32\ZKwXydG.exe
        
        C:\Windows\System32\ZKwXydG.exe
        5⤵
        
        PID:6216
    - - C:\Windows\System32\LXEFTpl.exe
        
        C:\Windows\System32\LXEFTpl.exe
        5⤵
        
        PID:5412
    - - C:\Windows\System32\fkPupHU.exe
        
        C:\Windows\System32\fkPupHU.exe
        5⤵
        
        PID:6468
    - - C:\Windows\System32\vFCTbyP.exe
        
        C:\Windows\System32\vFCTbyP.exe
        5⤵
        
        PID:6544
    - - C:\Windows\System32\uwhVNNc.exe
        
        C:\Windows\System32\uwhVNNc.exe
        5⤵
        
        PID:4960
    - - C:\Windows\System32\IwAJdWI.exe
        
        C:\Windows\System32\IwAJdWI.exe
        5⤵
        
        PID:6920
    - - C:\Windows\System32\elnNPYL.exe
        
        C:\Windows\System32\elnNPYL.exe
        5⤵
        
        PID:6968
    - - C:\Windows\System32\iFHspxf.exe
        
        C:\Windows\System32\iFHspxf.exe
        5⤵
        
        PID:5296
    - - C:\Windows\System32\AcrtBEC.exe
        
        C:\Windows\System32\AcrtBEC.exe
        5⤵
        
        PID:6668
    - - C:\Windows\System32\yhHscky.exe
        
        C:\Windows\System32\yhHscky.exe
        5⤵
        
        PID:6224
    - - C:\Windows\System32\asSavKn.exe
        
        C:\Windows\System32\asSavKn.exe
        5⤵
        
        PID:8212
    - - C:\Windows\System32\ynWCMkB.exe
        
        C:\Windows\System32\ynWCMkB.exe
        5⤵
        
        PID:8228
    - - C:\Windows\System32\auFHNll.exe
        
        C:\Windows\System32\auFHNll.exe
        5⤵
        
        PID:8244
    - - C:\Windows\System32\tnAsoCt.exe
        
        C:\Windows\System32\tnAsoCt.exe
        5⤵
        
        PID:8260
    - - C:\Windows\System32\fZhZpMl.exe
        
        C:\Windows\System32\fZhZpMl.exe
        5⤵
        
        PID:8280
    - - C:\Windows\System32\hRfDhJZ.exe
        
        C:\Windows\System32\hRfDhJZ.exe
        5⤵
        
        PID:8324
    - - C:\Windows\System32\fHnvPmV.exe
        
        C:\Windows\System32\fHnvPmV.exe
        5⤵
        
        PID:8344
    - - C:\Windows\System32\yFGgCwE.exe
        
        C:\Windows\System32\yFGgCwE.exe
        5⤵
        
        PID:8360
    - - C:\Windows\System32\aqaavWs.exe
        
        C:\Windows\System32\aqaavWs.exe
        5⤵
        
        PID:8376
    - - C:\Windows\System32\xbJJAPe.exe
        
        C:\Windows\System32\xbJJAPe.exe
        5⤵
        
        PID:8392
    - - C:\Windows\System32\LeOzuVf.exe
        
        C:\Windows\System32\LeOzuVf.exe
        5⤵
        
        PID:8688
    - - C:\Windows\System32\ovWHHmX.exe
        
        C:\Windows\System32\ovWHHmX.exe
        5⤵
        
        PID:8780
    - - C:\Windows\System32\BJQdsfV.exe
        
        C:\Windows\System32\BJQdsfV.exe
        5⤵
        
        PID:8828
    - - C:\Windows\System32\oGYNoAZ.exe
        
        C:\Windows\System32\oGYNoAZ.exe
        5⤵
        
        PID:8848
    - - C:\Windows\System32\zvPNVYO.exe
        
        C:\Windows\System32\zvPNVYO.exe
        5⤵
        
        PID:8868
    - - C:\Windows\System32\foFrpBB.exe
        
        C:\Windows\System32\foFrpBB.exe
        5⤵
        
        PID:8884
    - - C:\Windows\System32\TXMQzcn.exe
        
        C:\Windows\System32\TXMQzcn.exe
        5⤵
        
        PID:8900
    - - C:\Windows\System32\HnGwLvO.exe
        
        C:\Windows\System32\HnGwLvO.exe
        5⤵
        
        PID:8916
    - - C:\Windows\System32\YkzBSMV.exe
        
        C:\Windows\System32\YkzBSMV.exe
        5⤵
        
        PID:8964
    - - C:\Windows\System32\DwbLzHm.exe
        
        C:\Windows\System32\DwbLzHm.exe
        5⤵
        
        PID:8984
    - - C:\Windows\System32\GByXwId.exe
        
        C:\Windows\System32\GByXwId.exe
        5⤵
        
        PID:9000
    - - C:\Windows\System32\ZiDdqpV.exe
        
        C:\Windows\System32\ZiDdqpV.exe
        5⤵
        
        PID:9016
    - - C:\Windows\System32\wCvSBfC.exe
        
        C:\Windows\System32\wCvSBfC.exe
        5⤵
        
        PID:9040
    - - C:\Windows\System32\YrJMWrE.exe
        
        C:\Windows\System32\YrJMWrE.exe
        5⤵
        
        PID:9056
    - - C:\Windows\System32\aolMpGm.exe
        
        C:\Windows\System32\aolMpGm.exe
        5⤵
        
        PID:9072
    - - C:\Windows\System32\gINByhO.exe
        
        C:\Windows\System32\gINByhO.exe
        5⤵
        
        PID:9096
    - - C:\Windows\System32\MCaWBZi.exe
        
        C:\Windows\System32\MCaWBZi.exe
        5⤵
        
        PID:9112
    - - C:\Windows\System32\ximrVeN.exe
        
        C:\Windows\System32\ximrVeN.exe
        5⤵
        
        PID:9128
    - - C:\Windows\System32\CrkvPjx.exe
        
        C:\Windows\System32\CrkvPjx.exe
        5⤵
        
        PID:9152
    - - C:\Windows\System32\YPrfavu.exe
        
        C:\Windows\System32\YPrfavu.exe
        5⤵
        
        PID:9172
    - - C:\Windows\System32\ofUhAUP.exe
        
        C:\Windows\System32\ofUhAUP.exe
        5⤵
        
        PID:9188
    - - C:\Windows\System32\XZjcWza.exe
        
        C:\Windows\System32\XZjcWza.exe
        5⤵
        
        PID:9212
    - - C:\Windows\System32\cYhnUdl.exe
        
        C:\Windows\System32\cYhnUdl.exe
        5⤵
        
        PID:7324
    - - C:\Windows\System32\UiwwOiZ.exe
        
        C:\Windows\System32\UiwwOiZ.exe
        5⤵
        
        PID:7468
    - - C:\Windows\System32\umhubFP.exe
        
        C:\Windows\System32\umhubFP.exe
        5⤵
        
        PID:6452
    - - C:\Windows\System32\SnSzOQs.exe
        
        C:\Windows\System32\SnSzOQs.exe
        5⤵
        
        PID:7672
    - - C:\Windows\System32\BnXgyTh.exe
        
        C:\Windows\System32\BnXgyTh.exe
        5⤵
        
        PID:7832
    - - C:\Windows\System32\LHQMDVR.exe
        
        C:\Windows\System32\LHQMDVR.exe
        5⤵
        
        PID:8064
    - - C:\Windows\System32\kNenMcz.exe
        
        C:\Windows\System32\kNenMcz.exe
        5⤵
        
        PID:5676
    - - C:\Windows\System32\HVQnYAC.exe
        
        C:\Windows\System32\HVQnYAC.exe
        5⤵
        
        PID:2880
    - - C:\Windows\System32\UPWhldv.exe
        
        C:\Windows\System32\UPWhldv.exe
        5⤵
        
        PID:4244
    - - C:\Windows\System32\wnaTheL.exe
        
        C:\Windows\System32\wnaTheL.exe
        5⤵
        
        PID:8208
    - - C:\Windows\System32\oHXgZWO.exe
        
        C:\Windows\System32\oHXgZWO.exe
        5⤵
        
        PID:7248
    - - C:\Windows\System32\gFDWRMI.exe
        
        C:\Windows\System32\gFDWRMI.exe
        5⤵
        
        PID:7372
    - - C:\Windows\System32\OHOLzUK.exe
        
        C:\Windows\System32\OHOLzUK.exe
        5⤵
        
        PID:7844
    - - C:\Windows\System32\wnvAHEa.exe
        
        C:\Windows\System32\wnvAHEa.exe
        5⤵
        
        PID:7696
    - - C:\Windows\System32\JyUExKI.exe
        
        C:\Windows\System32\JyUExKI.exe
        5⤵
        
        PID:7524
    - - C:\Windows\System32\HIpNRft.exe
        
        C:\Windows\System32\HIpNRft.exe
        5⤵
        
        PID:7544
    - - C:\Windows\System32\vSwulwu.exe
        
        C:\Windows\System32\vSwulwu.exe
        5⤵
        
        PID:7616
    - - C:\Windows\System32\peoBEEH.exe
        
        C:\Windows\System32\peoBEEH.exe
        5⤵
        
        PID:8332
    - - C:\Windows\System32\BTZDvsW.exe
        
        C:\Windows\System32\BTZDvsW.exe
        5⤵
        
        PID:7808
    - - C:\Windows\System32\ACoDkQh.exe
        
        C:\Windows\System32\ACoDkQh.exe
        5⤵
        
        PID:7936
    - - C:\Windows\System32\INpApww.exe
        
        C:\Windows\System32\INpApww.exe
        5⤵
        
        PID:7984
    - - C:\Windows\System32\liHQFdq.exe
        
        C:\Windows\System32\liHQFdq.exe
        5⤵
        
        PID:8028
    - - C:\Windows\System32\eyXayxi.exe
        
        C:\Windows\System32\eyXayxi.exe
        5⤵
        
        PID:6688
    - - C:\Windows\System32\OENQJKC.exe
        
        C:\Windows\System32\OENQJKC.exe
        5⤵
        
        PID:5932
    - - C:\Windows\System32\YXekXmW.exe
        
        C:\Windows\System32\YXekXmW.exe
        5⤵
        
        PID:6720
    - - C:\Windows\System32\lgShQqY.exe
        
        C:\Windows\System32\lgShQqY.exe
        5⤵
        
        PID:9224
    - - C:\Windows\System32\kPuhFOa.exe
        
        C:\Windows\System32\kPuhFOa.exe
        5⤵
        
        PID:9244
    - - C:\Windows\System32\kdGBNXS.exe
        
        C:\Windows\System32\kdGBNXS.exe
        5⤵
        
        PID:9272
    - - C:\Windows\System32\jhtKPfx.exe
        
        C:\Windows\System32\jhtKPfx.exe
        5⤵
        
        PID:9324
    - - C:\Windows\System32\Rvibmke.exe
        
        C:\Windows\System32\Rvibmke.exe
        5⤵
        
        PID:9348
    - - C:\Windows\System32\TNBRPXT.exe
        
        C:\Windows\System32\TNBRPXT.exe
        5⤵
        
        PID:9364
    - - C:\Windows\System32\WLInWVQ.exe
        
        C:\Windows\System32\WLInWVQ.exe
        5⤵
        
        PID:9388
    - - C:\Windows\System32\nOqUEaM.exe
        
        C:\Windows\System32\nOqUEaM.exe
        5⤵
        
        PID:9404
    - - C:\Windows\System32\FBggNVi.exe
        
        C:\Windows\System32\FBggNVi.exe
        5⤵
        
        PID:9432
    - - C:\Windows\System32\einmPFe.exe
        
        C:\Windows\System32\einmPFe.exe
        5⤵
        
        PID:9448
    - - C:\Windows\System32\bguYiaj.exe
        
        C:\Windows\System32\bguYiaj.exe
        5⤵
        
        PID:9468
    - - C:\Windows\System32\hCWZvxA.exe
        
        C:\Windows\System32\hCWZvxA.exe
        5⤵
        
        PID:9492
    - - C:\Windows\System32\lkalPQW.exe
        
        C:\Windows\System32\lkalPQW.exe
        5⤵
        
        PID:9516
    - - C:\Windows\System32\FABRUBI.exe
        
        C:\Windows\System32\FABRUBI.exe
        5⤵
        
        PID:9532
    - - C:\Windows\System32\PjXCYbo.exe
        
        C:\Windows\System32\PjXCYbo.exe
        5⤵
        
        PID:9548
    - - C:\Windows\System32\fzvbYvM.exe
        
        C:\Windows\System32\fzvbYvM.exe
        5⤵
        
        PID:9572
    - - C:\Windows\System32\lRqNWju.exe
        
        C:\Windows\System32\lRqNWju.exe
        5⤵
        
        PID:9588
    - - C:\Windows\System32\ZNCLNuu.exe
        
        C:\Windows\System32\ZNCLNuu.exe
        5⤵
        
        PID:9608
    - - C:\Windows\System32\nduFOAJ.exe
        
        C:\Windows\System32\nduFOAJ.exe
        5⤵
        
        PID:9628
    - - C:\Windows\System32\tbSdoIj.exe
        
        C:\Windows\System32\tbSdoIj.exe
        5⤵
        
        PID:9676
    - - C:\Windows\System32\ySEaPCd.exe
        
        C:\Windows\System32\ySEaPCd.exe
        5⤵
        
        PID:9696
    - - C:\Windows\System32\zNgprqE.exe
        
        C:\Windows\System32\zNgprqE.exe
        5⤵
        
        PID:9720
    - - C:\Windows\System32\SIwaEsT.exe
        
        C:\Windows\System32\SIwaEsT.exe
        5⤵
        
        PID:9740
    - - C:\Windows\System32\esQSlkC.exe
        
        C:\Windows\System32\esQSlkC.exe
        5⤵
        
        PID:9756
    - - C:\Windows\System32\QYdqtzm.exe
        
        C:\Windows\System32\QYdqtzm.exe
        5⤵
        
        PID:9792
    - - C:\Windows\System32\cHrQqiG.exe
        
        C:\Windows\System32\cHrQqiG.exe
        5⤵
        
        PID:9812
    - - C:\Windows\System32\aicHBFS.exe
        
        C:\Windows\System32\aicHBFS.exe
        5⤵
        
        PID:9828
    - - C:\Windows\System32\mQkLIwk.exe
        
        C:\Windows\System32\mQkLIwk.exe
        5⤵
        
        PID:9848
    - - C:\Windows\System32\faydYVp.exe
        
        C:\Windows\System32\faydYVp.exe
        5⤵
        
        PID:9868
    - - C:\Windows\System32\PpXmoLB.exe
        
        C:\Windows\System32\PpXmoLB.exe
        5⤵
        
        PID:9884
    - - C:\Windows\System32\CxROvGF.exe
        
        C:\Windows\System32\CxROvGF.exe
        5⤵
        
        PID:9900
    - - C:\Windows\System32\GkoFkXe.exe
        
        C:\Windows\System32\GkoFkXe.exe
        5⤵
        
        PID:9920
    - - C:\Windows\System32\RoxXYEE.exe
        
        C:\Windows\System32\RoxXYEE.exe
        5⤵
        
        PID:9960
    - - C:\Windows\System32\lBmdVvg.exe
        
        C:\Windows\System32\lBmdVvg.exe
        5⤵
        
        PID:9980
    - - C:\Windows\System32\BvXJgYy.exe
        
        C:\Windows\System32\BvXJgYy.exe
        5⤵
        
        PID:10016
    - - C:\Windows\System32\mMBruXo.exe
        
        C:\Windows\System32\mMBruXo.exe
        5⤵
        
        PID:10052
    - - C:\Windows\System32\bvzbZhD.exe
        
        C:\Windows\System32\bvzbZhD.exe
        5⤵
        
        PID:10072
    - - C:\Windows\System32\rNqZSyN.exe
        
        C:\Windows\System32\rNqZSyN.exe
        5⤵
        
        PID:10092
    - - C:\Windows\System32\IClxiAm.exe
        
        C:\Windows\System32\IClxiAm.exe
        5⤵
        
        PID:10120
    - - C:\Windows\System32\zqyHguh.exe
        
        C:\Windows\System32\zqyHguh.exe
        5⤵
        
        PID:10136
    - - C:\Windows\System32\NLpkyYC.exe
        
        C:\Windows\System32\NLpkyYC.exe
        5⤵
        
        PID:10152
    - - C:\Windows\System32\blsKWYC.exe
        
        C:\Windows\System32\blsKWYC.exe
        5⤵
        
        PID:10180
    - - C:\Windows\System32\MlUkdJb.exe
        
        C:\Windows\System32\MlUkdJb.exe
        5⤵
        
        PID:10196
    - - C:\Windows\System32\rGNJuMu.exe
        
        C:\Windows\System32\rGNJuMu.exe
        5⤵
        
        PID:10224
    - - C:\Windows\System32\BnVhkpS.exe
        
        C:\Windows\System32\BnVhkpS.exe
        5⤵
        
        PID:7000
    - - C:\Windows\System32\EuHPAgN.exe
        
        C:\Windows\System32\EuHPAgN.exe
        5⤵
        
        PID:7172
    - - C:\Windows\System32\zDoYWNi.exe
        
        C:\Windows\System32\zDoYWNi.exe
        5⤵
        
        PID:7188
    - - C:\Windows\System32\NVsZnco.exe
        
        C:\Windows\System32\NVsZnco.exe
        5⤵
        
        PID:8256
    - - C:\Windows\System32\UfnOUEt.exe
        
        C:\Windows\System32\UfnOUEt.exe
        5⤵
        
        PID:7280
    - - C:\Windows\System32\hKRKcQd.exe
        
        C:\Windows\System32\hKRKcQd.exe
        5⤵
        
        PID:3588
    - - C:\Windows\System32\wihyiGl.exe
        
        C:\Windows\System32\wihyiGl.exe
        5⤵
        
        PID:7480
    - - C:\Windows\System32\IFrqPqQ.exe
        
        C:\Windows\System32\IFrqPqQ.exe
        5⤵
        
        PID:7724
    - - C:\Windows\System32\OqFXbdz.exe
        
        C:\Windows\System32\OqFXbdz.exe
        5⤵
        
        PID:3248
    - - C:\Windows\System32\AVtbLXg.exe
        
        C:\Windows\System32\AVtbLXg.exe
        5⤵
        
        PID:10260
    - - C:\Windows\System32\yntMulF.exe
        
        C:\Windows\System32\yntMulF.exe
        5⤵
        
        PID:10876
    - - C:\Windows\System32\DGKGeot.exe
        
        C:\Windows\System32\DGKGeot.exe
        5⤵
        
        PID:10908
    - - C:\Windows\System32\jepBZEG.exe
        
        C:\Windows\System32\jepBZEG.exe
        5⤵
        
        PID:10960
    - - C:\Windows\System32\poRCddV.exe
        
        C:\Windows\System32\poRCddV.exe
        5⤵
        
        PID:10980
    - - C:\Windows\System32\WdhHGky.exe
        
        C:\Windows\System32\WdhHGky.exe
        5⤵
        
        PID:10996
    - - C:\Windows\System32\RvAZznB.exe
        
        C:\Windows\System32\RvAZznB.exe
        5⤵
        
        PID:11012
    - - C:\Windows\System32\mmpcLSu.exe
        
        C:\Windows\System32\mmpcLSu.exe
        5⤵
        
        PID:11036
    - - C:\Windows\System32\KHxngGQ.exe
        
        C:\Windows\System32\KHxngGQ.exe
        5⤵
        
        PID:11056
    - - C:\Windows\System32\meAKGqv.exe
        
        C:\Windows\System32\meAKGqv.exe
        5⤵
        
        PID:11076
    - - C:\Windows\System32\gxQhfyW.exe
        
        C:\Windows\System32\gxQhfyW.exe
        5⤵
        
        PID:11104
    - - C:\Windows\System32\hNaPyWE.exe
        
        C:\Windows\System32\hNaPyWE.exe
        5⤵
        
        PID:11120
    - - C:\Windows\System32\nEdWVpk.exe
        
        C:\Windows\System32\nEdWVpk.exe
        5⤵
        
        PID:11140
    - - C:\Windows\System32\mQcFjgd.exe
        
        C:\Windows\System32\mQcFjgd.exe
        5⤵
        
        PID:11160
    - - C:\Windows\System32\CTMhFUw.exe
        
        C:\Windows\System32\CTMhFUw.exe
        5⤵
        
        PID:11180
    - - C:\Windows\System32\JKDjXam.exe
        
        C:\Windows\System32\JKDjXam.exe
        5⤵
        
        PID:11204
    - - C:\Windows\System32\FgbZGoi.exe
        
        C:\Windows\System32\FgbZGoi.exe
        5⤵
        
        PID:11220
    - - C:\Windows\System32\fGTsHoe.exe
        
        C:\Windows\System32\fGTsHoe.exe
        5⤵
        
        PID:11240
    - - C:\Windows\System32\DPONLgP.exe
        
        C:\Windows\System32\DPONLgP.exe
        5⤵
        
        PID:11260
    - - C:\Windows\System32\vifisnJ.exe
        
        C:\Windows\System32\vifisnJ.exe
        5⤵
        
        PID:7692
    - - C:\Windows\System32\AXvjcHu.exe
        
        C:\Windows\System32\AXvjcHu.exe
        5⤵
        
        PID:8792
    - - C:\Windows\System32\gzARGiQ.exe
        
        C:\Windows\System32\gzARGiQ.exe
        5⤵
        
        PID:8824
    - - C:\Windows\System32\TfQndlf.exe
        
        C:\Windows\System32\TfQndlf.exe
        5⤵
        
        PID:8444
    - - C:\Windows\System32\xQHxfhv.exe
        
        C:\Windows\System32\xQHxfhv.exe
        5⤵
        
        PID:7788
    - - C:\Windows\System32\nxgjqQU.exe
        
        C:\Windows\System32\nxgjqQU.exe
        5⤵
        
        PID:9024
    - - C:\Windows\System32\FqbCahg.exe
        
        C:\Windows\System32\FqbCahg.exe
        5⤵
        
        PID:9124
    - - C:\Windows\System32\IORvnhO.exe
        
        C:\Windows\System32\IORvnhO.exe
        5⤵
        
        PID:7304
    - - C:\Windows\System32\UHnMOYJ.exe
        
        C:\Windows\System32\UHnMOYJ.exe
        5⤵
        
        PID:7732
    - - C:\Windows\System32\VJfpEYh.exe
        
        C:\Windows\System32\VJfpEYh.exe
        5⤵
        
        PID:8128
    - - C:\Windows\System32\ChzulfC.exe
        
        C:\Windows\System32\ChzulfC.exe
        5⤵
        
        PID:6608
    - - C:\Windows\System32\yJWysrg.exe
        
        C:\Windows\System32\yJWysrg.exe
        5⤵
        
        PID:9252
    - - C:\Windows\System32\dXOShKB.exe
        
        C:\Windows\System32\dXOShKB.exe
        5⤵
        
        PID:9464
    - - C:\Windows\System32\eCkMJAc.exe
        
        C:\Windows\System32\eCkMJAc.exe
        5⤵
        
        PID:772
    - - C:\Windows\System32\TWgfzeZ.exe
        
        C:\Windows\System32\TWgfzeZ.exe
        5⤵
        
        PID:9560
    - - C:\Windows\System32\zgYbEwj.exe
        
        C:\Windows\System32\zgYbEwj.exe
        5⤵
        
        PID:9732
    - - C:\Windows\System32\nLwnooY.exe
        
        C:\Windows\System32\nLwnooY.exe
        5⤵
        
        PID:9772
    - - C:\Windows\System32\pSQgtfL.exe
        
        C:\Windows\System32\pSQgtfL.exe
        5⤵
        
        PID:9912
    - - C:\Windows\System32\snhWHbY.exe
        
        C:\Windows\System32\snhWHbY.exe
        5⤵
        
        PID:7700
    - - C:\Windows\System32\IEQQgeX.exe
        
        C:\Windows\System32\IEQQgeX.exe
        5⤵
        
        PID:9944
    - - C:\Windows\System32\OrjgZoB.exe
        
        C:\Windows\System32\OrjgZoB.exe
        5⤵
        
        PID:9976
    - - C:\Windows\System32\gpEuVAv.exe
        
        C:\Windows\System32\gpEuVAv.exe
        5⤵
        
        PID:8384
    - - C:\Windows\System32\sjniEXC.exe
        
        C:\Windows\System32\sjniEXC.exe
        5⤵
        
        PID:8252
    - - C:\Windows\System32\yzTbsRn.exe
        
        C:\Windows\System32\yzTbsRn.exe
        5⤵
        
        PID:7064
    - - C:\Windows\System32\ZTWNGOU.exe
        
        C:\Windows\System32\ZTWNGOU.exe
        5⤵
        
        PID:6444
    - - C:\Windows\System32\CiTZAAy.exe
        
        C:\Windows\System32\CiTZAAy.exe
        5⤵
        
        PID:8188
    - - C:\Windows\System32\dJriICk.exe
        
        C:\Windows\System32\dJriICk.exe
        5⤵
        
        PID:8060
    - - C:\Windows\System32\DCrJQST.exe
        
        C:\Windows\System32\DCrJQST.exe
        5⤵
        
        PID:7928
    - - C:\Windows\System32\bQdnHOh.exe
        
        C:\Windows\System32\bQdnHOh.exe
        5⤵
        
        PID:10028
    - - C:\Windows\System32\pakZqoZ.exe
        
        C:\Windows\System32\pakZqoZ.exe
        5⤵
        
        PID:8416
    - - C:\Windows\System32\BQhLYOi.exe
        
        C:\Windows\System32\BQhLYOi.exe
        5⤵
        
        PID:10212
    - - C:\Windows\System32\QOgaZIT.exe
        
        C:\Windows\System32\QOgaZIT.exe
        5⤵
        
        PID:8636
    - - C:\Windows\System32\cLCQkyA.exe
        
        C:\Windows\System32\cLCQkyA.exe
        5⤵
        
        PID:6872
    - - C:\Windows\System32\NBRMFqU.exe
        
        C:\Windows\System32\NBRMFqU.exe
        5⤵
        
        PID:8644
    - - C:\Windows\System32\QWSohfp.exe
        
        C:\Windows\System32\QWSohfp.exe
        5⤵
        
        PID:4828
    - - C:\Windows\System32\qaEQBsT.exe
        
        C:\Windows\System32\qaEQBsT.exe
        5⤵
        
        PID:8992
    - - C:\Windows\System32\ZPNAcsf.exe
        
        C:\Windows\System32\ZPNAcsf.exe
        5⤵
        
        PID:7428
    - - C:\Windows\System32\Phcnort.exe
        
        C:\Windows\System32\Phcnort.exe
        5⤵
        
        PID:7612
    - - C:\Windows\System32\AzLqIYG.exe
        
        C:\Windows\System32\AzLqIYG.exe
        5⤵
        
        PID:7584
    - - C:\Windows\System32\xWaFuRv.exe
        
        C:\Windows\System32\xWaFuRv.exe
        5⤵
        
        PID:9220
    - - C:\Windows\System32\KxYhkHx.exe
        
        C:\Windows\System32\KxYhkHx.exe
        5⤵
        
        PID:9312
    - - C:\Windows\System32\vqCTBkc.exe
        
        C:\Windows\System32\vqCTBkc.exe
        5⤵
        
        PID:9384
    - - C:\Windows\System32\IRLNgZs.exe
        
        C:\Windows\System32\IRLNgZs.exe
        5⤵
        
        PID:9420
    - - C:\Windows\System32\IEWmujx.exe
        
        C:\Windows\System32\IEWmujx.exe
        5⤵
        
        PID:9540
    - - C:\Windows\System32\OZgzzNB.exe
        
        C:\Windows\System32\OZgzzNB.exe
        5⤵
        
        PID:9644
    - - C:\Windows\System32\nfqOaDR.exe
        
        C:\Windows\System32\nfqOaDR.exe
        5⤵
        
        PID:9688
    - - C:\Windows\System32\HfiqLbx.exe
        
        C:\Windows\System32\HfiqLbx.exe
        5⤵
        
        PID:11280
    - - C:\Windows\System32\zFMRXhR.exe
        
        C:\Windows\System32\zFMRXhR.exe
        5⤵
        
        PID:11300
    - - C:\Windows\System32\MhKBTBv.exe
        
        C:\Windows\System32\MhKBTBv.exe
        5⤵
        
        PID:11324
    - - C:\Windows\System32\LhAPhKM.exe
        
        C:\Windows\System32\LhAPhKM.exe
        5⤵
        
        PID:11344
    - - C:\Windows\System32\LIuOhFx.exe
        
        C:\Windows\System32\LIuOhFx.exe
        5⤵
        
        PID:11364
    - - C:\Windows\System32\YNBnoJC.exe
        
        C:\Windows\System32\YNBnoJC.exe
        5⤵
        
        PID:11388
    - - C:\Windows\System32\zAhpQHu.exe
        
        C:\Windows\System32\zAhpQHu.exe
        5⤵
        
        PID:11416
    - - C:\Windows\System32\pTQlXPl.exe
        
        C:\Windows\System32\pTQlXPl.exe
        5⤵
        
        PID:11456
    - - C:\Windows\System32\cASMCFv.exe
        
        C:\Windows\System32\cASMCFv.exe
        5⤵
        
        PID:11492
    - - C:\Windows\System32\fBnijSB.exe
        
        C:\Windows\System32\fBnijSB.exe
        5⤵
        
        PID:11508
    - - C:\Windows\System32\YazpZHd.exe
        
        C:\Windows\System32\YazpZHd.exe
        5⤵
        
        PID:11524
    - - C:\Windows\System32\LZOVXvu.exe
        
        C:\Windows\System32\LZOVXvu.exe
        5⤵
        
        PID:11540
    - - C:\Windows\System32\IOXoGjn.exe
        
        C:\Windows\System32\IOXoGjn.exe
        5⤵
        
        PID:11560
    - - C:\Windows\System32\qlSCbFf.exe
        
        C:\Windows\System32\qlSCbFf.exe
        5⤵
        
        PID:11580
    - - C:\Windows\System32\atyRuue.exe
        
        C:\Windows\System32\atyRuue.exe
        5⤵
        
        PID:11596
    - - C:\Windows\System32\OChVece.exe
        
        C:\Windows\System32\OChVece.exe
        5⤵
        
        PID:11624
    - - C:\Windows\System32\SGYfTKI.exe
        
        C:\Windows\System32\SGYfTKI.exe
        5⤵
        
        PID:11648
    - - C:\Windows\System32\GDOeKys.exe
        
        C:\Windows\System32\GDOeKys.exe
        5⤵
        
        PID:11664
    - - C:\Windows\System32\YZensVL.exe
        
        C:\Windows\System32\YZensVL.exe
        5⤵
        
        PID:11684
    - - C:\Windows\System32\GFJlAUv.exe
        
        C:\Windows\System32\GFJlAUv.exe
        5⤵
        
        PID:11704
    - - C:\Windows\System32\YZaZLWX.exe
        
        C:\Windows\System32\YZaZLWX.exe
        5⤵
        
        PID:11728
    - - C:\Windows\System32\HehrSUu.exe
        
        C:\Windows\System32\HehrSUu.exe
        5⤵
        
        PID:11752
    - - C:\Windows\System32\nEdnLRo.exe
        
        C:\Windows\System32\nEdnLRo.exe
        5⤵
        
        PID:11772
    - - C:\Windows\System32\AMSFNZH.exe
        
        C:\Windows\System32\AMSFNZH.exe
        5⤵
        
        PID:11792
    - - C:\Windows\System32\FaYbzVU.exe
        
        C:\Windows\System32\FaYbzVU.exe
        5⤵
        
        PID:11816
    - - C:\Windows\System32\kgvbqfe.exe
        
        C:\Windows\System32\kgvbqfe.exe
        5⤵
        
        PID:11836
    - - C:\Windows\System32\yqJWGtG.exe
        
        C:\Windows\System32\yqJWGtG.exe
        5⤵
        
        PID:11860
    - - C:\Windows\System32\pxaodKU.exe
        
        C:\Windows\System32\pxaodKU.exe
        5⤵
        
        PID:11876
    - - C:\Windows\System32\HsDjPCM.exe
        
        C:\Windows\System32\HsDjPCM.exe
        5⤵
        
        PID:11900
    - - C:\Windows\System32\AUQRuRP.exe
        
        C:\Windows\System32\AUQRuRP.exe
        5⤵
        
        PID:11916
    - - C:\Windows\System32\dQnXaFs.exe
        
        C:\Windows\System32\dQnXaFs.exe
        5⤵
        
        PID:11932
    - - C:\Windows\System32\gRJOUzS.exe
        
        C:\Windows\System32\gRJOUzS.exe
        5⤵
        
        PID:11956
    - - C:\Windows\System32\IIXldPr.exe
        
        C:\Windows\System32\IIXldPr.exe
        5⤵
        
        PID:11980
    - - C:\Windows\System32\MOwMYqb.exe
        
        C:\Windows\System32\MOwMYqb.exe
        5⤵
        
        PID:12020
    - - C:\Windows\System32\uxjFUBI.exe
        
        C:\Windows\System32\uxjFUBI.exe
        5⤵
        
        PID:12040
    - - C:\Windows\System32\faEaLyI.exe
        
        C:\Windows\System32\faEaLyI.exe
        5⤵
        
        PID:12056
    - - C:\Windows\System32\RreZvdo.exe
        
        C:\Windows\System32\RreZvdo.exe
        5⤵
        
        PID:12072
    - - C:\Windows\System32\rFmrCwi.exe
        
        C:\Windows\System32\rFmrCwi.exe
        5⤵
        
        PID:12092
    - - C:\Windows\System32\GpHQeih.exe
        
        C:\Windows\System32\GpHQeih.exe
        5⤵
        
        PID:12112
    - - C:\Windows\System32\ZlttuFy.exe
        
        C:\Windows\System32\ZlttuFy.exe
        5⤵
        
        PID:12128
    - - C:\Windows\System32\suAgzbH.exe
        
        C:\Windows\System32\suAgzbH.exe
        5⤵
        
        PID:12148
    - - C:\Windows\System32\wUGAZkf.exe
        
        C:\Windows\System32\wUGAZkf.exe
        5⤵
        
        PID:12168
    - - C:\Windows\System32\cZSbeWr.exe
        
        C:\Windows\System32\cZSbeWr.exe
        5⤵
        
        PID:12200
    - - C:\Windows\System32\VzHjCTM.exe
        
        C:\Windows\System32\VzHjCTM.exe
        5⤵
        
        PID:12228
    - - C:\Windows\System32\UnHfZEN.exe
        
        C:\Windows\System32\UnHfZEN.exe
        5⤵
        
        PID:12268
    - - C:\Windows\System32\iYQIeEi.exe
        
        C:\Windows\System32\iYQIeEi.exe
        5⤵
        
        PID:9752
    - - C:\Windows\System32\JJNiolP.exe
        
        C:\Windows\System32\JJNiolP.exe
        5⤵
        
        PID:4644
    - - C:\Windows\System32\tZKBrEH.exe
        
        C:\Windows\System32\tZKBrEH.exe
        5⤵
        
        PID:10752
    - - C:\Windows\System32\AqEyWkC.exe
        
        C:\Windows\System32\AqEyWkC.exe
        5⤵
        
        PID:10144
    - - C:\Windows\System32\tCfVfWv.exe
        
        C:\Windows\System32\tCfVfWv.exe
        5⤵
        
        PID:1744
    - - C:\Windows\System32\zCvDGEF.exe
        
        C:\Windows\System32\zCvDGEF.exe
        5⤵
        
        PID:8656
    - - C:\Windows\System32\kdAvbiX.exe
        
        C:\Windows\System32\kdAvbiX.exe
        5⤵
        
        PID:8704
    - - C:\Windows\System32\EFUHyeF.exe
        
        C:\Windows\System32\EFUHyeF.exe
        5⤵
        
        PID:8732
    - - C:\Windows\System32\SumkYqB.exe
        
        C:\Windows\System32\SumkYqB.exe
        5⤵
        
        PID:8652
    - - C:\Windows\System32\FEXpPJU.exe
        
        C:\Windows\System32\FEXpPJU.exe
        5⤵
        
        PID:8696
    - - C:\Windows\System32\qUkKWIr.exe
        
        C:\Windows\System32\qUkKWIr.exe
        5⤵
        
        PID:8856
    - - C:\Windows\System32\mXYHcBi.exe
        
        C:\Windows\System32\mXYHcBi.exe
        5⤵
        
        PID:8880
    - - C:\Windows\System32\Blohblc.exe
        
        C:\Windows\System32\Blohblc.exe
        5⤵
        
        PID:8932
    - - C:\Windows\System32\EahMxGH.exe
        
        C:\Windows\System32\EahMxGH.exe
        5⤵
        
        PID:8980
    - - C:\Windows\System32\euYVyjw.exe
        
        C:\Windows\System32\euYVyjw.exe
        5⤵
        
        PID:8032
    - - C:\Windows\System32\vjGcYhF.exe
        
        C:\Windows\System32\vjGcYhF.exe
        5⤵
        
        PID:9168
    - - C:\Windows\System32\wjcYsWo.exe
        
        C:\Windows\System32\wjcYsWo.exe
        5⤵
        
        PID:2548
    - - C:\Windows\System32\XIalaHP.exe
        
        C:\Windows\System32\XIalaHP.exe
        5⤵
        
        PID:12304
    - - C:\Windows\System32\cUHtWlg.exe
        
        C:\Windows\System32\cUHtWlg.exe
        5⤵
        
        PID:12332
    - - C:\Windows\System32\OraZCje.exe
        
        C:\Windows\System32\OraZCje.exe
        5⤵
        
        PID:12352
    - - C:\Windows\System32\ZjeYWzc.exe
        
        C:\Windows\System32\ZjeYWzc.exe
        5⤵
        
        PID:12372
    - - C:\Windows\System32\xqLEuXW.exe
        
        C:\Windows\System32\xqLEuXW.exe
        5⤵
        
        PID:12388
    - - C:\Windows\System32\dLFqtML.exe
        
        C:\Windows\System32\dLFqtML.exe
        5⤵
        
        PID:12412
    - - C:\Windows\System32\ElXAmSC.exe
        
        C:\Windows\System32\ElXAmSC.exe
        5⤵
        
        PID:12436
    - - C:\Windows\System32\nkVDgCs.exe
        
        C:\Windows\System32\nkVDgCs.exe
        5⤵
        
        PID:12460
    - - C:\Windows\System32\GOYwAVy.exe
        
        C:\Windows\System32\GOYwAVy.exe
        5⤵
        
        PID:12496
    - - C:\Windows\System32\XyTaDMr.exe
        
        C:\Windows\System32\XyTaDMr.exe
        5⤵
        
        PID:12516
    - - C:\Windows\System32\ODRxpaM.exe
        
        C:\Windows\System32\ODRxpaM.exe
        5⤵
        
        PID:12532
    - - C:\Windows\System32\BEGnRra.exe
        
        C:\Windows\System32\BEGnRra.exe
        5⤵
        
        PID:12556
    - - C:\Windows\System32\ngjiNRN.exe
        
        C:\Windows\System32\ngjiNRN.exe
        5⤵
        
        PID:12580
    - - C:\Windows\System32\ECMWNPp.exe
        
        C:\Windows\System32\ECMWNPp.exe
        5⤵
        
        PID:12600
    - - C:\Windows\System32\QLxnaib.exe
        
        C:\Windows\System32\QLxnaib.exe
        5⤵
        
        PID:12624
    - - C:\Windows\System32\PXCUorK.exe
        
        C:\Windows\System32\PXCUorK.exe
        5⤵
        
        PID:12648
    - - C:\Windows\System32\EFjYlBa.exe
        
        C:\Windows\System32\EFjYlBa.exe
        5⤵
        
        PID:12672
    - - C:\Windows\System32\eGLhLmN.exe
        
        C:\Windows\System32\eGLhLmN.exe
        5⤵
        
        PID:12688
    - - C:\Windows\System32\BWkMKrT.exe
        
        C:\Windows\System32\BWkMKrT.exe
        5⤵
        
        PID:12708
    - - C:\Windows\System32\hWWfrtP.exe
        
        C:\Windows\System32\hWWfrtP.exe
        5⤵
        
        PID:12740
    - - C:\Windows\System32\ovFYqMq.exe
        
        C:\Windows\System32\ovFYqMq.exe
        5⤵
        
        PID:12756
    - - C:\Windows\System32\KDylkbM.exe
        
        C:\Windows\System32\KDylkbM.exe
        5⤵
        
        PID:12780
    - - C:\Windows\System32\fOtQoAn.exe
        
        C:\Windows\System32\fOtQoAn.exe
        5⤵
        
        PID:12800
    - - C:\Windows\System32\cEgcaxq.exe
        
        C:\Windows\System32\cEgcaxq.exe
        5⤵
        
        PID:12824
    - - C:\Windows\System32\LCraBXx.exe
        
        C:\Windows\System32\LCraBXx.exe
        5⤵
        
        PID:12844
    - - C:\Windows\System32\cFxSWCw.exe
        
        C:\Windows\System32\cFxSWCw.exe
        5⤵
        
        PID:12860
    - - C:\Windows\System32\KesSXEY.exe
        
        C:\Windows\System32\KesSXEY.exe
        5⤵
        
        PID:12880
    - - C:\Windows\System32\XIxrbbc.exe
        
        C:\Windows\System32\XIxrbbc.exe
        5⤵
        
        PID:12900
    - - C:\Windows\System32\kNONYXB.exe
        
        C:\Windows\System32\kNONYXB.exe
        5⤵
        
        PID:12916
    - - C:\Windows\System32\TpMRpiX.exe
        
        C:\Windows\System32\TpMRpiX.exe
        5⤵
        
        PID:12940
    - - C:\Windows\System32\LpwMhWs.exe
        
        C:\Windows\System32\LpwMhWs.exe
        5⤵
        
        PID:12968
    - - C:\Windows\System32\AsZmcdJ.exe
        
        C:\Windows\System32\AsZmcdJ.exe
        5⤵
        
        PID:12984
    - - C:\Windows\System32\DiVuCOg.exe
        
        C:\Windows\System32\DiVuCOg.exe
        5⤵
        
        PID:13004
    - - C:\Windows\System32\doipZvf.exe
        
        C:\Windows\System32\doipZvf.exe
        5⤵
        
        PID:13020
    - - C:\Windows\System32\PeQhmSF.exe
        
        C:\Windows\System32\PeQhmSF.exe
        5⤵
        
        PID:13048
    - - C:\Windows\System32\pUAxxMB.exe
        
        C:\Windows\System32\pUAxxMB.exe
        5⤵
        
        PID:13064
    - - C:\Windows\System32\otuOWLG.exe
        
        C:\Windows\System32\otuOWLG.exe
        5⤵
        
        PID:13096
    - - C:\Windows\System32\KeutUgp.exe
        
        C:\Windows\System32\KeutUgp.exe
        5⤵
        
        PID:13116
    - - C:\Windows\System32\xVIYIpj.exe
        
        C:\Windows\System32\xVIYIpj.exe
        5⤵
        
        PID:13136
    - - C:\Windows\System32\bSezogW.exe
        
        C:\Windows\System32\bSezogW.exe
        5⤵
        
        PID:13164
    - - C:\Windows\System32\ofpWduN.exe
        
        C:\Windows\System32\ofpWduN.exe
        5⤵
        
        PID:13180
    - - C:\Windows\System32\xDWcIXU.exe
        
        C:\Windows\System32\xDWcIXU.exe
        5⤵
        
        PID:13204
    - - C:\Windows\System32\pFiXOBc.exe
        
        C:\Windows\System32\pFiXOBc.exe
        5⤵
        
        PID:13224
    - - C:\Windows\System32\iMRkjvl.exe
        
        C:\Windows\System32\iMRkjvl.exe
        5⤵
        
        PID:13248
    - - C:\Windows\System32\mZmUHBs.exe
        
        C:\Windows\System32\mZmUHBs.exe
        5⤵
        
        PID:13268
    - - C:\Windows\System32\htFivYH.exe
        
        C:\Windows\System32\htFivYH.exe
        5⤵
        
        PID:13288
    - - C:\Windows\System32\HnIMAHM.exe
        
        C:\Windows\System32\HnIMAHM.exe
        5⤵
        
        PID:13308
    - - C:\Windows\System32\hjPJWMh.exe
        
        C:\Windows\System32\hjPJWMh.exe
        5⤵
        
        PID:5516
    - - C:\Windows\System32\QkTeQcx.exe
        
        C:\Windows\System32\QkTeQcx.exe
        5⤵
        
        PID:10416
    - - C:\Windows\System32\VXQgYPj.exe
        
        C:\Windows\System32\VXQgYPj.exe
        5⤵
        
        PID:10320
    - - C:\Windows\System32\ksEbvUu.exe
        
        C:\Windows\System32\ksEbvUu.exe
        5⤵
        
        PID:7848
    - - C:\Windows\System32\xnJgXGt.exe
        
        C:\Windows\System32\xnJgXGt.exe
        5⤵
        
        PID:8520
    - - C:\Windows\System32\JDMmaQg.exe
        
        C:\Windows\System32\JDMmaQg.exe
        5⤵
        
        PID:8488
    - - C:\Windows\System32\slWQsBD.exe
        
        C:\Windows\System32\slWQsBD.exe
        5⤵
        
        PID:9260
    - - C:\Windows\System32\jTrbxWD.exe
        
        C:\Windows\System32\jTrbxWD.exe
        5⤵
        
        PID:9896
    - - C:\Windows\System32\QgaedGW.exe
        
        C:\Windows\System32\QgaedGW.exe
        5⤵
        
        PID:9928
    - - C:\Windows\System32\HZjnNQl.exe
        
        C:\Windows\System32\HZjnNQl.exe
        5⤵
        
        PID:9440
    - - C:\Windows\System32\TQVhVVb.exe
        
        C:\Windows\System32\TQVhVVb.exe
        5⤵
        
        PID:9460
    - - C:\Windows\System32\NnPMvNG.exe
        
        C:\Windows\System32\NnPMvNG.exe
        5⤵
        
        PID:10628
    - - C:\Windows\System32\DzCtUzv.exe
        
        C:\Windows\System32\DzCtUzv.exe
        5⤵
        
        PID:4860
    - - C:\Windows\System32\xaPCLGD.exe
        
        C:\Windows\System32\xaPCLGD.exe
        5⤵
        
        PID:10472
    - - C:\Windows\System32\CjpZaEn.exe
        
        C:\Windows\System32\CjpZaEn.exe
        5⤵
        
        PID:9372
    - - C:\Windows\System32\JQBrRFN.exe
        
        C:\Windows\System32\JQBrRFN.exe
        5⤵
        
        PID:9704
    - - C:\Windows\System32\yzHHtIC.exe
        
        C:\Windows\System32\yzHHtIC.exe
        5⤵
        
        PID:11272
    - - C:\Windows\System32\hBdtcAJ.exe
        
        C:\Windows\System32\hBdtcAJ.exe
        5⤵
        
        PID:11356
    - - C:\Windows\System32\RAQfDDy.exe
        
        C:\Windows\System32\RAQfDDy.exe
        5⤵
        
        PID:13324
    - - C:\Windows\System32\pgQhRmu.exe
        
        C:\Windows\System32\pgQhRmu.exe
        5⤵
        
        PID:13348
    - - C:\Windows\System32\LMULFhl.exe
        
        C:\Windows\System32\LMULFhl.exe
        5⤵
        
        PID:13364
    - - C:\Windows\System32\ZuwbWmD.exe
        
        C:\Windows\System32\ZuwbWmD.exe
        5⤵
        
        PID:13388
    - - C:\Windows\System32\BuQGXGy.exe
        
        C:\Windows\System32\BuQGXGy.exe
        5⤵
        
        PID:13404
    - - C:\Windows\System32\PBorLru.exe
        
        C:\Windows\System32\PBorLru.exe
        5⤵
        
        PID:13424
    - - C:\Windows\System32\MjKgXlt.exe
        
        C:\Windows\System32\MjKgXlt.exe
        5⤵
        
        PID:13452
    - - C:\Windows\System32\asdRrDb.exe
        
        C:\Windows\System32\asdRrDb.exe
        5⤵
        
        PID:13468
    - - C:\Windows\System32\hIqTkjs.exe
        
        C:\Windows\System32\hIqTkjs.exe
        5⤵
        
        PID:13492
    - - C:\Windows\System32\mnyXvWS.exe
        
        C:\Windows\System32\mnyXvWS.exe
        5⤵
        
        PID:13512
    - - C:\Windows\System32\LiFjDgw.exe
        
        C:\Windows\System32\LiFjDgw.exe
        5⤵
        
        PID:13544
    - - C:\Windows\System32\tykTLzT.exe
        
        C:\Windows\System32\tykTLzT.exe
        5⤵
        
        PID:13568
    - - C:\Windows\System32\jgisyir.exe
        
        C:\Windows\System32\jgisyir.exe
        5⤵
        
        PID:13584
    - - C:\Windows\System32\EyECjRh.exe
        
        C:\Windows\System32\EyECjRh.exe
        5⤵
        
        PID:13600
    - - C:\Windows\System32\dGcscdi.exe
        
        C:\Windows\System32\dGcscdi.exe
        5⤵
        
        PID:13616
    - - C:\Windows\System32\AZOZyGy.exe
        
        C:\Windows\System32\AZOZyGy.exe
        5⤵
        
        PID:13636
    - - C:\Windows\System32\qulAiYK.exe
        
        C:\Windows\System32\qulAiYK.exe
        5⤵
        
        PID:13652
    - - C:\Windows\System32\ZPVyIqN.exe
        
        C:\Windows\System32\ZPVyIqN.exe
        5⤵
        
        PID:13672
    - - C:\Windows\System32\CLLAFQJ.exe
        
        C:\Windows\System32\CLLAFQJ.exe
        5⤵
        
        PID:13800
    - - C:\Windows\System32\MPBNYfM.exe
        
        C:\Windows\System32\MPBNYfM.exe
        5⤵
        
        PID:13824
    - - C:\Windows\System32\PqFDeCy.exe
        
        C:\Windows\System32\PqFDeCy.exe
        5⤵
        
        PID:10696
    - - C:\Windows\System32\CNDbntj.exe
        
        C:\Windows\System32\CNDbntj.exe
        5⤵
        
        PID:9876
    - - C:\Windows\System32\iMJzlxR.exe
        
        C:\Windows\System32\iMJzlxR.exe
        5⤵
        
        PID:10716
    - - C:\Windows\System32\HnGDPAm.exe
        
        C:\Windows\System32\HnGDPAm.exe
        5⤵
        
        PID:11504
    - - C:\Windows\System32\rRMLrnX.exe
        
        C:\Windows\System32\rRMLrnX.exe
        5⤵
        
        PID:11536
    - - C:\Windows\System32\gziKmlI.exe
        
        C:\Windows\System32\gziKmlI.exe
        5⤵
        
        PID:10760
    - - C:\Windows\System32\BUTSVed.exe
        
        C:\Windows\System32\BUTSVed.exe
        5⤵
        
        PID:10080
    - - C:\Windows\System32\sCQraxb.exe
        
        C:\Windows\System32\sCQraxb.exe
        5⤵
        
        PID:10128
    - - C:\Windows\System32\RPXAtpD.exe
        
        C:\Windows\System32\RPXAtpD.exe
        5⤵
        
        PID:7200
    - - C:\Windows\System32\rFgpUDH.exe
        
        C:\Windows\System32\rFgpUDH.exe
        5⤵
        
        PID:7268
    - - C:\Windows\System32\UZPUNcn.exe
        
        C:\Windows\System32\UZPUNcn.exe
        5⤵
        
        PID:7408
    - - C:\Windows\System32\GFOuuLN.exe
        
        C:\Windows\System32\GFOuuLN.exe
        5⤵
        
        PID:7644
    - - C:\Windows\System32\pswLLPi.exe
        
        C:\Windows\System32\pswLLPi.exe
        5⤵
        
        PID:12052
    - - C:\Windows\System32\XNPuywg.exe
        
        C:\Windows\System32\XNPuywg.exe
        5⤵
        
        PID:10856
    - - C:\Windows\System32\Azdmjep.exe
        
        C:\Windows\System32\Azdmjep.exe
        5⤵
        
        PID:10300
    - - C:\Windows\System32\toNGxqi.exe
        
        C:\Windows\System32\toNGxqi.exe
        5⤵
        
        PID:10328
    - - C:\Windows\System32\qbfegFe.exe
        
        C:\Windows\System32\qbfegFe.exe
        5⤵
        
        PID:9204
    - - C:\Windows\System32\gChSHpj.exe
        
        C:\Windows\System32\gChSHpj.exe
        5⤵
        
        PID:10244
    - - C:\Windows\System32\JnFmRrJ.exe
        
        C:\Windows\System32\JnFmRrJ.exe
        5⤵
        
        PID:9120
    - - C:\Windows\System32\uOgVUES.exe
        
        C:\Windows\System32\uOgVUES.exe
        5⤵
        
        PID:9108
    - - C:\Windows\System32\UwTvwyP.exe
        
        C:\Windows\System32\UwTvwyP.exe
        5⤵
        
        PID:8740
    - - C:\Windows\System32\PpqAUWZ.exe
        
        C:\Windows\System32\PpqAUWZ.exe
        5⤵
        
        PID:12380
    - - C:\Windows\System32\zzwsufZ.exe
        
        C:\Windows\System32\zzwsufZ.exe
        5⤵
        
        PID:10480
    - - C:\Windows\System32\zfDZBqy.exe
        
        C:\Windows\System32\zfDZBqy.exe
        5⤵
        
        PID:12948
    - - C:\Windows\System32\CYhbMNt.exe
        
        C:\Windows\System32\CYhbMNt.exe
        5⤵
        
        PID:7604
    - - C:\Windows\System32\AtxgHXF.exe
        
        C:\Windows\System32\AtxgHXF.exe
        5⤵
        
        PID:7444
    - - C:\Windows\System32\emcASLs.exe
        
        C:\Windows\System32\emcASLs.exe
        5⤵
        
        PID:12564
    - - C:\Windows\System32\wKbUjYf.exe
        
        C:\Windows\System32\wKbUjYf.exe
        5⤵
        
        PID:10640
    - - C:\Windows\System32\QrKXvgF.exe
        
        C:\Windows\System32\QrKXvgF.exe
        5⤵
        
        PID:11288
    - - C:\Windows\System32\VEzeraj.exe
        
        C:\Windows\System32\VEzeraj.exe
        5⤵
        
        PID:10704
    - - C:\Windows\System32\wIfSjFu.exe
        
        C:\Windows\System32\wIfSjFu.exe
        5⤵
        
        PID:11436
    - - C:\Windows\System32\erCJPvQ.exe
        
        C:\Windows\System32\erCJPvQ.exe
        5⤵
        
        PID:13628
    - - C:\Windows\System32\ubaOgai.exe
        
        C:\Windows\System32\ubaOgai.exe
        5⤵
        
        PID:11644
    - - C:\Windows\System32\dMZukur.exe
        
        C:\Windows\System32\dMZukur.exe
        5⤵
        
        PID:11696
    - - C:\Windows\System32\iSoqKeY.exe
        
        C:\Windows\System32\iSoqKeY.exe
        5⤵
        
        PID:11724
    - - C:\Windows\System32\mzSanfT.exe
        
        C:\Windows\System32\mzSanfT.exe
        5⤵
        
        PID:11788
    - - C:\Windows\System32\soOLMPp.exe
        
        C:\Windows\System32\soOLMPp.exe
        5⤵
        
        PID:11748
    - - C:\Windows\System32\ikEUKQW.exe
        
        C:\Windows\System32\ikEUKQW.exe
        5⤵
        
        PID:11924
    - - C:\Windows\System32\VHgEyxl.exe
        
        C:\Windows\System32\VHgEyxl.exe
        5⤵
        
        PID:7412
    - - C:\Windows\System32\xssLqTZ.exe
        
        C:\Windows\System32\xssLqTZ.exe
        5⤵
        
        PID:12176
    - - C:\Windows\System32\sAnzhEW.exe
        
        C:\Windows\System32\sAnzhEW.exe
        5⤵
        
        PID:10920
    - - C:\Windows\System32\WDDlzyi.exe
        
        C:\Windows\System32\WDDlzyi.exe
        5⤵
        
        PID:10936
    - - C:\Windows\System32\lghgqAs.exe
        
        C:\Windows\System32\lghgqAs.exe
        5⤵
        
        PID:11020
    - - C:\Windows\System32\YyfilrH.exe
        
        C:\Windows\System32\YyfilrH.exe
        5⤵
        
        PID:13756
    - - C:\Windows\System32\pmpMBhK.exe
        
        C:\Windows\System32\pmpMBhK.exe
        5⤵
        
        PID:11072
    - - C:\Windows\System32\Juwgbbf.exe
        
        C:\Windows\System32\Juwgbbf.exe
        5⤵
        
        PID:11136
    - - C:\Windows\System32\YrPRiwI.exe
        
        C:\Windows\System32\YrPRiwI.exe
        5⤵
        
        PID:11168
    - - C:\Windows\System32\nwCdndb.exe
        
        C:\Windows\System32\nwCdndb.exe
        5⤵
        
        PID:8200
    - - C:\Windows\System32\dipIxyh.exe
        
        C:\Windows\System32\dipIxyh.exe
        5⤵
        
        PID:5220
    - - C:\Windows\System32\enSBWun.exe
        
        C:\Windows\System32\enSBWun.exe
        5⤵
        
        PID:9012
    - - C:\Windows\System32\KXmDqvf.exe
        
        C:\Windows\System32\KXmDqvf.exe
        5⤵
        
        PID:8800
    - - C:\Windows\System32\TYXbZPn.exe
        
        C:\Windows\System32\TYXbZPn.exe
        5⤵
        
        PID:8776
    - - C:\Windows\System32\VkRLixm.exe
        
        C:\Windows\System32\VkRLixm.exe
        5⤵
        
        PID:7684
    - - C:\Windows\System32\abKXEMn.exe
        
        C:\Windows\System32\abKXEMn.exe
        5⤵
        
        PID:7080
    - - C:\Windows\System32\jqAzzTd.exe
        
        C:\Windows\System32\jqAzzTd.exe
        5⤵
        
        PID:12312
    - - C:\Windows\System32\OqcIJiz.exe
        
        C:\Windows\System32\OqcIJiz.exe
        5⤵
        
        PID:8864
    - - C:\Windows\System32\ibtYWIW.exe
        
        C:\Windows\System32\ibtYWIW.exe
        5⤵
        
        PID:11868
    - - C:\Windows\System32\TEjENNN.exe
        
        C:\Windows\System32\TEjENNN.exe
        5⤵
        
        PID:12432
    - - C:\Windows\System32\cKolrNN.exe
        
        C:\Windows\System32\cKolrNN.exe
        5⤵
        
        PID:12400
    - - C:\Windows\System32\YurDnCG.exe
        
        C:\Windows\System32\YurDnCG.exe
        5⤵
        
        PID:12552
    - - C:\Windows\System32\QTraVXa.exe
        
        C:\Windows\System32\QTraVXa.exe
        5⤵
        
        PID:6384
    - - C:\Windows\System32\zdNpKos.exe
        
        C:\Windows\System32\zdNpKos.exe
        5⤵
        
        PID:8544
    - - C:\Windows\System32\byjsNQY.exe
        
        C:\Windows\System32\byjsNQY.exe
        5⤵
        
        PID:9556
    - - C:\Windows\System32\CuYRHEY.exe
        
        C:\Windows\System32\CuYRHEY.exe
        5⤵
        
        PID:13156
    - - C:\Windows\System32\ZOFicaL.exe
        
        C:\Windows\System32\ZOFicaL.exe
        5⤵
        
        PID:8336
    - - C:\Windows\System32\zbGOzAU.exe
        
        C:\Windows\System32\zbGOzAU.exe
        5⤵
        
        PID:13232
    - - C:\Windows\System32\lsYrzUR.exe
        
        C:\Windows\System32\lsYrzUR.exe
        5⤵
        
        PID:5024
    - - C:\Windows\System32\cWjhIYI.exe
        
        C:\Windows\System32\cWjhIYI.exe
        5⤵
        
        PID:10012
    - - C:\Windows\System32\FMfTBpE.exe
        
        C:\Windows\System32\FMfTBpE.exe
        5⤵
        
        PID:13924
    - - C:\Windows\System32\XgGAMlI.exe
        
        C:\Windows\System32\XgGAMlI.exe
        5⤵
        
        PID:10544
    - - C:\Windows\System32\WlVdcLf.exe
        
        C:\Windows\System32\WlVdcLf.exe
        5⤵
        
        PID:2144
    - - C:\Windows\System32\oJpwioS.exe
        
        C:\Windows\System32\oJpwioS.exe
        5⤵
        
        PID:7260
    - - C:\Windows\System32\VNZIkyS.exe
        
        C:\Windows\System32\VNZIkyS.exe
        5⤵
        
        PID:8836
    - - C:\Windows\System32\xXFtwgz.exe
        
        C:\Windows\System32\xXFtwgz.exe
        5⤵
        
        PID:8912
    - - C:\Windows\System32\yyswNeR.exe
        
        C:\Windows\System32\yyswNeR.exe
        5⤵
        
        PID:9400
    - - C:\Windows\System32\FsRUwpR.exe
        
        C:\Windows\System32\FsRUwpR.exe
        5⤵
        
        PID:11384
    - - C:\Windows\System32\gAFYOUe.exe
        
        C:\Windows\System32\gAFYOUe.exe
        5⤵
        
        PID:13372
    - - C:\Windows\System32\ABslCBm.exe
        
        C:\Windows\System32\ABslCBm.exe
        5⤵
        
        PID:13420
    - - C:\Windows\System32\GKZmbZD.exe
        
        C:\Windows\System32\GKZmbZD.exe
        5⤵
        
        PID:11480
    - - C:\Windows\System32\uORzkVl.exe
        
        C:\Windows\System32\uORzkVl.exe
        5⤵
        
        PID:11616
    - - C:\Windows\System32\LVVhPkn.exe
        
        C:\Windows\System32\LVVhPkn.exe
        5⤵
        
        PID:11948
    - - C:\Windows\System32\KujLqJC.exe
        
        C:\Windows\System32\KujLqJC.exe
        5⤵
        
        PID:12036
    - - C:\Windows\System32\PmhxNUx.exe
        
        C:\Windows\System32\PmhxNUx.exe
        5⤵
        
        PID:12196
    - - C:\Windows\System32\udWWaaW.exe
        
        C:\Windows\System32\udWWaaW.exe
        5⤵
        
        PID:14048
    - - C:\Windows\System32\WEYdxhd.exe
        
        C:\Windows\System32\WEYdxhd.exe
        5⤵
        
        PID:10116
    - - C:\Windows\System32\jONTxSr.exe
        
        C:\Windows\System32\jONTxSr.exe
        5⤵
        
        PID:8676
    - - C:\Windows\System32\HpPgqjP.exe
        
        C:\Windows\System32\HpPgqjP.exe
        5⤵
        
        PID:12328
    - - C:\Windows\System32\wpnhQPf.exe
        
        C:\Windows\System32\wpnhQPf.exe
        5⤵
        
        PID:12064
    - - C:\Windows\System32\QLceDUA.exe
        
        C:\Windows\System32\QLceDUA.exe
        5⤵
        
        PID:12156
    - - C:\Windows\System32\YSWQsYQ.exe
        
        C:\Windows\System32\YSWQsYQ.exe
        5⤵
        
        PID:12280
    - - C:\Windows\System32\USTssYc.exe
        
        C:\Windows\System32\USTssYc.exe
        5⤵
        
        PID:11804
    - - C:\Windows\System32\xuqXewF.exe
        
        C:\Windows\System32\xuqXewF.exe
        5⤵
        
        PID:12480
    - - C:\Windows\System32\uGshoNd.exe
        
        C:\Windows\System32\uGshoNd.exe
        5⤵
        
        PID:12572
    - - C:\Windows\System32\fkbDeQo.exe
        
        C:\Windows\System32\fkbDeQo.exe
        5⤵
        
        PID:12792
    - - C:\Windows\System32\evqEFSQ.exe
        
        C:\Windows\System32\evqEFSQ.exe
        5⤵
        
        PID:12856
    - - C:\Windows\System32\eNfzRcr.exe
        
        C:\Windows\System32\eNfzRcr.exe
        5⤵
        
        PID:12924
    - - C:\Windows\System32\oofKruF.exe
        
        C:\Windows\System32\oofKruF.exe
        5⤵
        
        PID:13016
    - - C:\Windows\System32\WvUNhnB.exe
        
        C:\Windows\System32\WvUNhnB.exe
        5⤵
        
        PID:13088
    - - C:\Windows\System32\CUQXScR.exe
        
        C:\Windows\System32\CUQXScR.exe
        5⤵
        
        PID:11320
    - - C:\Windows\System32\uaeEzEo.exe
        
        C:\Windows\System32\uaeEzEo.exe
        5⤵
        
        PID:13464
    - - C:\Windows\System32\AevVWlt.exe
        
        C:\Windows\System32\AevVWlt.exe
        5⤵
        
        PID:13532
    - - C:\Windows\System32\zanscFH.exe
        
        C:\Windows\System32\zanscFH.exe
        5⤵
        
        PID:12680
    - - C:\Windows\System32\mmimabM.exe
        
        C:\Windows\System32\mmimabM.exe
        5⤵
        
        PID:12772
    - - C:\Windows\System32\oxGZPgS.exe
        
        C:\Windows\System32\oxGZPgS.exe
        5⤵
        
        PID:14160
    - - C:\Windows\System32\CDMaEzm.exe
        
        C:\Windows\System32\CDMaEzm.exe
        5⤵
        
        PID:12996
    - - C:\Windows\System32\Khqjdkq.exe
        
        C:\Windows\System32\Khqjdkq.exe
        5⤵
        
        PID:12892
    - - C:\Windows\System32\NRovFTP.exe
        
        C:\Windows\System32\NRovFTP.exe
        5⤵
        
        PID:5048
    - - C:\Windows\System32\VzDtFFJ.exe
        
        C:\Windows\System32\VzDtFFJ.exe
        5⤵
        
        PID:9596
    - - C:\Windows\System32\smDeFwf.exe
        
        C:\Windows\System32\smDeFwf.exe
        5⤵
        
        PID:13788
    - - C:\Windows\System32\ncHELrf.exe
        
        C:\Windows\System32\ncHELrf.exe
        5⤵
        
        PID:13812
    - - C:\Windows\System32\EklLIjt.exe
        
        C:\Windows\System32\EklLIjt.exe
        5⤵
        
        PID:14100
    - - C:\Windows\System32\dVbnZIo.exe
        
        C:\Windows\System32\dVbnZIo.exe
        5⤵
        
        PID:14004
    - - C:\Windows\System32\TipEWFA.exe
        
        C:\Windows\System32\TipEWFA.exe
        5⤵
        
        PID:12976
    - - C:\Windows\System32\EAoSuYj.exe
        
        C:\Windows\System32\EAoSuYj.exe
        5⤵
        
        PID:14192
    - - C:\Windows\System32\FAjQTUU.exe
        
        C:\Windows\System32\FAjQTUU.exe
        5⤵
        
        PID:9320
    - - C:\Windows\System32\mTwuipk.exe
        
        C:\Windows\System32\mTwuipk.exe
        5⤵
        
        PID:14228
    - - C:\Windows\System32\ZvIwtBb.exe
        
        C:\Windows\System32\ZvIwtBb.exe
        5⤵
        
        PID:13340
    - - C:\Windows\System32\oIksVpE.exe
        
        C:\Windows\System32\oIksVpE.exe
        5⤵
        
        PID:2336
    - - C:\Windows\System32\TEAHcpM.exe
        
        C:\Windows\System32\TEAHcpM.exe
        5⤵
        
        PID:13416
    - - C:\Windows\System32\NANQBeF.exe
        
        C:\Windows\System32\NANQBeF.exe
        5⤵
        
        PID:13576
    - - C:\Windows\System32\vSWNZUk.exe
        
        C:\Windows\System32\vSWNZUk.exe
        5⤵
        
        PID:11424
    - - C:\Windows\System32\BQWhwir.exe
        
        C:\Windows\System32\BQWhwir.exe
        5⤵
        
        PID:14356
    - - C:\Windows\System32\xveUFkl.exe
        
        C:\Windows\System32\xveUFkl.exe
        5⤵
        
        PID:14372
    - - C:\Windows\System32\SwTovlC.exe
        
        C:\Windows\System32\SwTovlC.exe
        5⤵
        
        PID:14396
    - - C:\Windows\System32\mkepimv.exe
        
        C:\Windows\System32\mkepimv.exe
        5⤵
        
        PID:14412
    - - C:\Windows\System32\mTmfThS.exe
        
        C:\Windows\System32\mTmfThS.exe
        5⤵
        
        PID:14436
    - - C:\Windows\System32\fNMAtli.exe
        
        C:\Windows\System32\fNMAtli.exe
        5⤵
        
        PID:14460
    - - C:\Windows\System32\UwMlMka.exe
        
        C:\Windows\System32\UwMlMka.exe
        5⤵
        
        PID:14480
    - - C:\Windows\System32\kqkTFmE.exe
        
        C:\Windows\System32\kqkTFmE.exe
        5⤵
        
        PID:14500
    - - C:\Windows\System32\YoktobH.exe
        
        C:\Windows\System32\YoktobH.exe
        5⤵
        
        PID:14516
    - - C:\Windows\System32\dtJRZZd.exe
        
        C:\Windows\System32\dtJRZZd.exe
        5⤵
        
        PID:14532
    - - C:\Windows\System32\DJjhYix.exe
        
        C:\Windows\System32\DJjhYix.exe
        5⤵
        
        PID:14556
    - - C:\Windows\System32\TKeLFsM.exe
        
        C:\Windows\System32\TKeLFsM.exe
        5⤵
        
        PID:14572
    - - C:\Windows\System32\fuxgRMJ.exe
        
        C:\Windows\System32\fuxgRMJ.exe
        5⤵
        
        PID:14596
    - - C:\Windows\System32\nCXbEoA.exe
        
        C:\Windows\System32\nCXbEoA.exe
        5⤵
        
        PID:14612
    - - C:\Windows\System32\jjvdLcw.exe
        
        C:\Windows\System32\jjvdLcw.exe
        5⤵
        
        PID:14636
    - - C:\Windows\System32\azNyueO.exe
        
        C:\Windows\System32\azNyueO.exe
        5⤵
        
        PID:14660
    - - C:\Windows\System32\TFyIeCC.exe
        
        C:\Windows\System32\TFyIeCC.exe
        5⤵
        
        PID:14688
    - - C:\Windows\System32\wnedMaY.exe
        
        C:\Windows\System32\wnedMaY.exe
        5⤵
        
        PID:14708
    - - C:\Windows\System32\CUaYWbF.exe
        
        C:\Windows\System32\CUaYWbF.exe
        5⤵
        
        PID:14728
    - - C:\Windows\System32\ziiZGKB.exe
        
        C:\Windows\System32\ziiZGKB.exe
        5⤵
        
        PID:14748
    - - C:\Windows\System32\uRLeMUR.exe
        
        C:\Windows\System32\uRLeMUR.exe
        5⤵
        
        PID:14768
    - - C:\Windows\System32\IDeBTJL.exe
        
        C:\Windows\System32\IDeBTJL.exe
        5⤵
        
        PID:14788
    - - C:\Windows\System32\BGcLVJZ.exe
        
        C:\Windows\System32\BGcLVJZ.exe
        5⤵
        
        PID:14808
    - - C:\Windows\System32\ZXdhavZ.exe
        
        C:\Windows\System32\ZXdhavZ.exe
        5⤵
        
        PID:14832
    - - C:\Windows\System32\YEctqLz.exe
        
        C:\Windows\System32\YEctqLz.exe
        5⤵
        
        PID:14856
    - - C:\Windows\System32\ftkHMIp.exe
        
        C:\Windows\System32\ftkHMIp.exe
        5⤵
        
        PID:14876
    - - C:\Windows\System32\viOEOmX.exe
        
        C:\Windows\System32\viOEOmX.exe
        5⤵
        
        PID:14924
    - - C:\Windows\System32\XClHntB.exe
        
        C:\Windows\System32\XClHntB.exe
        5⤵
        
        PID:14944
    - - C:\Windows\System32\TXmPNtg.exe
        
        C:\Windows\System32\TXmPNtg.exe
        5⤵
        
        PID:14964
    - - C:\Windows\System32\mxGvkEz.exe
        
        C:\Windows\System32\mxGvkEz.exe
        5⤵
        
        PID:14984
    - - C:\Windows\System32\vMUhIte.exe
        
        C:\Windows\System32\vMUhIte.exe
        5⤵
        
        PID:15000
    - - C:\Windows\System32\PuAiKNf.exe
        
        C:\Windows\System32\PuAiKNf.exe
        5⤵
        
        PID:15024
    - - C:\Windows\System32\gaDQORB.exe
        
        C:\Windows\System32\gaDQORB.exe
        5⤵
        
        PID:15040
    - - C:\Windows\System32\vXoSaMr.exe
        
        C:\Windows\System32\vXoSaMr.exe
        5⤵
        
        PID:15064
    - - C:\Windows\System32\PyOIrKk.exe
        
        C:\Windows\System32\PyOIrKk.exe
        5⤵
        
        PID:15088
    - - C:\Windows\System32\oMrzBzn.exe
        
        C:\Windows\System32\oMrzBzn.exe
        5⤵
        
        PID:15104
    - - C:\Windows\System32\XomNokg.exe
        
        C:\Windows\System32\XomNokg.exe
        5⤵
        
        PID:15128
    - - C:\Windows\System32\MUYCQed.exe
        
        C:\Windows\System32\MUYCQed.exe
        5⤵
        
        PID:15144
    - - C:\Windows\System32\VmtBsRk.exe
        
        C:\Windows\System32\VmtBsRk.exe
        5⤵
        
        PID:15172
    - - C:\Windows\System32\MPLstNd.exe
        
        C:\Windows\System32\MPLstNd.exe
        5⤵
        
        PID:15188
    - - C:\Windows\System32\eZTbWIZ.exe
        
        C:\Windows\System32\eZTbWIZ.exe
        5⤵
        
        PID:15208
    - - C:\Windows\System32\bHmehoj.exe
        
        C:\Windows\System32\bHmehoj.exe
        5⤵
        
        PID:15232
    - - C:\Windows\System32\bJlvLnG.exe
        
        C:\Windows\System32\bJlvLnG.exe
        5⤵
        
        PID:15256
    - - C:\Windows\System32\SzQHIkI.exe
        
        C:\Windows\System32\SzQHIkI.exe
        5⤵
        
        PID:15276
    - - C:\Windows\System32\mkUrUlz.exe
        
        C:\Windows\System32\mkUrUlz.exe
        5⤵
        
        PID:15296
    - - C:\Windows\System32\GkFsDzy.exe
        
        C:\Windows\System32\GkFsDzy.exe
        5⤵
        
        PID:15324
    - - C:\Windows\System32\bVYGsyQ.exe
        
        C:\Windows\System32\bVYGsyQ.exe
        5⤵
        
        PID:15340
    - - C:\Windows\System32\KyrShsu.exe
        
        C:\Windows\System32\KyrShsu.exe
        5⤵
        
        PID:8340
    - - C:\Windows\System32\xaFouqg.exe
        
        C:\Windows\System32\xaFouqg.exe
        5⤵
        
        PID:15364
    - - C:\Windows\System32\iHWjUFZ.exe
        
        C:\Windows\System32\iHWjUFZ.exe
        5⤵
        
        PID:15388
    - - C:\Windows\System32\ilhdUis.exe
        
        C:\Windows\System32\ilhdUis.exe
        5⤵
        
        PID:15404
    - - C:\Windows\System32\uyMzdEv.exe
        
        C:\Windows\System32\uyMzdEv.exe
        5⤵
        
        PID:15428
    - - C:\Windows\System32\hGXVnNQ.exe
        
        C:\Windows\System32\hGXVnNQ.exe
        5⤵
        
        PID:15452
    - - C:\Windows\System32\zgMYjfg.exe
        
        C:\Windows\System32\zgMYjfg.exe
        5⤵
        
        PID:15476
    - - C:\Windows\System32\OptRspQ.exe
        
        C:\Windows\System32\OptRspQ.exe
        5⤵
        
        PID:15496
    - - C:\Windows\System32\qaelyeo.exe
        
        C:\Windows\System32\qaelyeo.exe
        5⤵
        
        PID:15520
    - - C:\Windows\System32\lctTfAx.exe
        
        C:\Windows\System32\lctTfAx.exe
        5⤵
        
        PID:15536
    - - C:\Windows\System32\JVPqIza.exe
        
        C:\Windows\System32\JVPqIza.exe
        5⤵
        
        PID:15552
    - - C:\Windows\System32\tAHcHjI.exe
        
        C:\Windows\System32\tAHcHjI.exe
        5⤵
        
        PID:15568
    - - C:\Windows\System32\nQrXalm.exe
        
        C:\Windows\System32\nQrXalm.exe
        5⤵
        
        PID:15584
    - - C:\Windows\System32\HmwbVVe.exe
        
        C:\Windows\System32\HmwbVVe.exe
        5⤵
        
        PID:15600
    - - C:\Windows\System32\mOPqOty.exe
        
        C:\Windows\System32\mOPqOty.exe
        5⤵
        
        PID:15616
    - - C:\Windows\System32\xVOgSGt.exe
        
        C:\Windows\System32\xVOgSGt.exe
        5⤵
        
        PID:15632
    - - C:\Windows\System32\xaeYzPD.exe
        
        C:\Windows\System32\xaeYzPD.exe
        5⤵
        
        PID:15648
    - - C:\Windows\System32\actzAXb.exe
        
        C:\Windows\System32\actzAXb.exe
        5⤵
        
        PID:15664
    - - C:\Windows\System32\ecaBHdw.exe
        
        C:\Windows\System32\ecaBHdw.exe
        5⤵
        
        PID:15680
    - - C:\Windows\System32\FGkheyr.exe
        
        C:\Windows\System32\FGkheyr.exe
        5⤵
        
        PID:15704
    - - C:\Windows\System32\PrQuoaK.exe
        
        C:\Windows\System32\PrQuoaK.exe
        5⤵
        
        PID:15720
    - - C:\Windows\System32\qaCVeEJ.exe
        
        C:\Windows\System32\qaCVeEJ.exe
        5⤵
        
        PID:15752
    - - C:\Windows\System32\JWsDOSR.exe
        
        C:\Windows\System32\JWsDOSR.exe
        5⤵
        
        PID:15768
    - - C:\Windows\System32\wIDhimq.exe
        
        C:\Windows\System32\wIDhimq.exe
        5⤵
        
        PID:15784
    - - C:\Windows\System32\cHxtwUW.exe
        
        C:\Windows\System32\cHxtwUW.exe
        5⤵
        
        PID:15808
    - - C:\Windows\System32\UjbLrHA.exe
        
        C:\Windows\System32\UjbLrHA.exe
        5⤵
        
        PID:15832
    - - C:\Windows\System32\LyUNxxR.exe
        
        C:\Windows\System32\LyUNxxR.exe
        5⤵
        
        PID:15872
    - - C:\Windows\System32\OkgHjvD.exe
        
        C:\Windows\System32\OkgHjvD.exe
        5⤵
        
        PID:15896
    - - C:\Windows\System32\ryWumbx.exe
        
        C:\Windows\System32\ryWumbx.exe
        5⤵
        
        PID:15924
    - - C:\Windows\System32\cRJBOdV.exe
        
        C:\Windows\System32\cRJBOdV.exe
        5⤵
        
        PID:15948
    - - C:\Windows\System32\mhqdeRS.exe
        
        C:\Windows\System32\mhqdeRS.exe
        5⤵
        
        PID:15972
    - - C:\Windows\System32\IMFilID.exe
        
        C:\Windows\System32\IMFilID.exe
        5⤵
        
        PID:15988
    - - C:\Windows\System32\AGLOTEa.exe
        
        C:\Windows\System32\AGLOTEa.exe
        5⤵
        
        PID:16012
    - - C:\Windows\System32\EIjPVxD.exe
        
        C:\Windows\System32\EIjPVxD.exe
        5⤵
        
        PID:16036
    - - C:\Windows\System32\cNTomRn.exe
        
        C:\Windows\System32\cNTomRn.exe
        5⤵
        
        PID:16064
    - - C:\Windows\System32\EwFlDHG.exe
        
        C:\Windows\System32\EwFlDHG.exe
        5⤵
        
        PID:16088
    - - C:\Windows\System32\JygyXsK.exe
        
        C:\Windows\System32\JygyXsK.exe
        5⤵
        
        PID:16132
    - - C:\Windows\System32\haVQCyg.exe
        
        C:\Windows\System32\haVQCyg.exe
        5⤵
        
        PID:16164
    - - C:\Windows\System32\EabQdGF.exe
        
        C:\Windows\System32\EabQdGF.exe
        5⤵
        
        PID:16180
    - - C:\Windows\System32\gZUyXGk.exe
        
        C:\Windows\System32\gZUyXGk.exe
        5⤵
        
        PID:16208
    - - C:\Windows\System32\FisLXvy.exe
        
        C:\Windows\System32\FisLXvy.exe
        5⤵
        
        PID:16228
    - - C:\Windows\System32\wlWqsFW.exe
        
        C:\Windows\System32\wlWqsFW.exe
        5⤵
        
        PID:16264
    - - C:\Windows\System32\bcpunSp.exe
        
        C:\Windows\System32\bcpunSp.exe
        5⤵
        
        PID:16296
    - - C:\Windows\System32\VGsVOks.exe
        
        C:\Windows\System32\VGsVOks.exe
        5⤵
        
        PID:16312
    - - C:\Windows\System32\nSmsqOL.exe
        
        C:\Windows\System32\nSmsqOL.exe
        5⤵
        
        PID:16336
    - - C:\Windows\System32\dBVhQSe.exe
        
        C:\Windows\System32\dBVhQSe.exe
        5⤵
        
        PID:16368
    - - C:\Windows\System32\pHOmiGB.exe
        
        C:\Windows\System32\pHOmiGB.exe
        5⤵
        
        PID:14136
    - - C:\Windows\System32\SXJdyXM.exe
        
        C:\Windows\System32\SXJdyXM.exe
        5⤵
        
        PID:13436
    - - C:\Windows\System32\MnbkESt.exe
        
        C:\Windows\System32\MnbkESt.exe
        5⤵
        
        PID:8944
    - - C:\Windows\System32\fJYDRGd.exe
        
        C:\Windows\System32\fJYDRGd.exe
        5⤵
        
        PID:13660
    - - C:\Windows\System32\XdjFziX.exe
        
        C:\Windows\System32\XdjFziX.exe
        5⤵
        
        PID:13696
    - - C:\Windows\System32\CGNvoSS.exe
        
        C:\Windows\System32\CGNvoSS.exe
        5⤵
        
        PID:11008
    - - C:\Windows\System32\oUhtPhs.exe
        
        C:\Windows\System32\oUhtPhs.exe
        5⤵
        
        PID:11152
    - - C:\Windows\System32\DRTtRSR.exe
        
        C:\Windows\System32\DRTtRSR.exe
        5⤵
        
        PID:8996
    - - C:\Windows\System32\MBfLAon.exe
        
        C:\Windows\System32\MBfLAon.exe
        5⤵
        
        PID:10000
    - - C:\Windows\System32\DuDWgPg.exe
        
        C:\Windows\System32\DuDWgPg.exe
        5⤵
        
        PID:11996
    - - C:\Windows\System32\FqdbXOc.exe
        
        C:\Windows\System32\FqdbXOc.exe
        5⤵
        
        PID:7368
    - - C:\Windows\System32\NiyZRCM.exe
        
        C:\Windows\System32\NiyZRCM.exe
        5⤵
        
        PID:11400
    - - C:\Windows\System32\RXXWrTZ.exe
        
        C:\Windows\System32\RXXWrTZ.exe
        5⤵
        
        PID:8612
    - - C:\Windows\System32\dxxHFmI.exe
        
        C:\Windows\System32\dxxHFmI.exe
        5⤵
        
        PID:12240
    - - C:\Windows\System32\ceGpXEc.exe
        
        C:\Windows\System32\ceGpXEc.exe
        5⤵
        
        PID:3204
    - - C:\Windows\System32\yPQbokU.exe
        
        C:\Windows\System32\yPQbokU.exe
        5⤵
        
        PID:13072
    - - C:\Windows\System32\dEHuxbi.exe
        
        C:\Windows\System32\dEHuxbi.exe
        5⤵
        
        PID:13084
    - - C:\Windows\System32\YPWKztN.exe
        
        C:\Windows\System32\YPWKztN.exe
        5⤵
        
        PID:14184
    - - C:\Windows\System32\CpwhuoS.exe
        
        C:\Windows\System32\CpwhuoS.exe
        5⤵
        
        PID:14544
    - - C:\Windows\System32\EFQlPdk.exe
        
        C:\Windows\System32\EFQlPdk.exe
        5⤵
        
        PID:14668
    - - C:\Windows\System32\pGGpepk.exe
        
        C:\Windows\System32\pGGpepk.exe
        5⤵
        
        PID:16388
    - - C:\Windows\System32\ZsdLGZu.exe
        
        C:\Windows\System32\ZsdLGZu.exe
        5⤵
        
        PID:16404
    - - C:\Windows\System32\jQSHvZp.exe
        
        C:\Windows\System32\jQSHvZp.exe
        5⤵
        
        PID:16428
    - - C:\Windows\System32\BaJMeDR.exe
        
        C:\Windows\System32\BaJMeDR.exe
        5⤵
        
        PID:16452
    - - C:\Windows\System32\ZbLREUZ.exe
        
        C:\Windows\System32\ZbLREUZ.exe
        5⤵
        
        PID:16472
    - - C:\Windows\System32\Wjqaxat.exe
        
        C:\Windows\System32\Wjqaxat.exe
        5⤵
        
        PID:16492
    - - C:\Windows\System32\CQGsZKT.exe
        
        C:\Windows\System32\CQGsZKT.exe
        5⤵
        
        PID:16512
    - - C:\Windows\System32\pKPYxEd.exe
        
        C:\Windows\System32\pKPYxEd.exe
        5⤵
        
        PID:16536
    - - C:\Windows\System32\qTBKoJw.exe
        
        C:\Windows\System32\qTBKoJw.exe
        5⤵
        
        PID:16560
    - - C:\Windows\System32\NRFjaPN.exe
        
        C:\Windows\System32\NRFjaPN.exe
        5⤵
        
        PID:16576
    - - C:\Windows\System32\xsWHXeL.exe
        
        C:\Windows\System32\xsWHXeL.exe
        5⤵
        
        PID:16596
    - - C:\Windows\System32\foegzbM.exe
        
        C:\Windows\System32\foegzbM.exe
        5⤵
        
        PID:16616
    - - C:\Windows\System32\HOzIltJ.exe
        
        C:\Windows\System32\HOzIltJ.exe
        5⤵
        
        PID:16636
    - - C:\Windows\System32\LBDEoaX.exe
        
        C:\Windows\System32\LBDEoaX.exe
        5⤵
        
        PID:16656
    - - C:\Windows\System32\gvzRQNK.exe
        
        C:\Windows\System32\gvzRQNK.exe
        5⤵
        
        PID:16672
    - - C:\Windows\System32\SdkgCJi.exe
        
        C:\Windows\System32\SdkgCJi.exe
        5⤵
        
        PID:16696
    - - C:\Windows\System32\pBQzHRU.exe
        
        C:\Windows\System32\pBQzHRU.exe
        5⤵
        
        PID:16712
    - - C:\Windows\System32\spYFEWP.exe
        
        C:\Windows\System32\spYFEWP.exe
        5⤵
        
        PID:16728
    - - C:\Windows\System32\HIDEnnY.exe
        
        C:\Windows\System32\HIDEnnY.exe
        5⤵
        
        PID:16744
    - - C:\Windows\System32\fecWZqE.exe
        
        C:\Windows\System32\fecWZqE.exe
        5⤵
        
        PID:16760
    - - C:\Windows\System32\fBVWton.exe
        
        C:\Windows\System32\fBVWton.exe
        5⤵
        
        PID:16776
    - - C:\Windows\System32\grjoAMY.exe
        
        C:\Windows\System32\grjoAMY.exe
        5⤵
        
        PID:16792
    - - C:\Windows\System32\pUMyPIr.exe
        
        C:\Windows\System32\pUMyPIr.exe
        5⤵
        
        PID:16808
    - - C:\Windows\System32\OBWcOvE.exe
        
        C:\Windows\System32\OBWcOvE.exe
        5⤵
        
        PID:16824
    - - C:\Windows\System32\NgGqZbJ.exe
        
        C:\Windows\System32\NgGqZbJ.exe
        5⤵
        
        PID:16840
    - - C:\Windows\System32\fRYLufJ.exe
        
        C:\Windows\System32\fRYLufJ.exe
        5⤵
        
        PID:16856
    - - C:\Windows\System32\LAZKMXZ.exe
        
        C:\Windows\System32\LAZKMXZ.exe
        5⤵
        
        PID:16872
    - - C:\Windows\System32\LMMsxZm.exe
        
        C:\Windows\System32\LMMsxZm.exe
        5⤵
        
        PID:16888
    - - C:\Windows\System32\dKZfErv.exe
        
        C:\Windows\System32\dKZfErv.exe
        5⤵
        
        PID:16908
    - - C:\Windows\System32\VkzfUNh.exe
        
        C:\Windows\System32\VkzfUNh.exe
        5⤵
        
        PID:16924
    - - C:\Windows\System32\kezHXiG.exe
        
        C:\Windows\System32\kezHXiG.exe
        5⤵
        
        PID:16964
    - - C:\Windows\System32\kjBekAa.exe
        
        C:\Windows\System32\kjBekAa.exe
        5⤵
        
        PID:17008
    - - C:\Windows\System32\FoGRLfZ.exe
        
        C:\Windows\System32\FoGRLfZ.exe
        5⤵
        
        PID:17056
    - - C:\Windows\System32\zZyozZS.exe
        
        C:\Windows\System32\zZyozZS.exe
        5⤵
        
        PID:17084
    - - C:\Windows\System32\xCOmNHd.exe
        
        C:\Windows\System32\xCOmNHd.exe
        5⤵
        
        PID:17104
    - - C:\Windows\System32\twAQePP.exe
        
        C:\Windows\System32\twAQePP.exe
        5⤵
        
        PID:17148
    - - C:\Windows\System32\sQsbMvB.exe
        
        C:\Windows\System32\sQsbMvB.exe
        5⤵
        
        PID:17168
    - - C:\Windows\System32\hHwhWTR.exe
        
        C:\Windows\System32\hHwhWTR.exe
        5⤵
        
        PID:17188
    - - C:\Windows\System32\qKovgyM.exe
        
        C:\Windows\System32\qKovgyM.exe
        5⤵
        
        PID:17212
    - - C:\Windows\System32\EdYubHP.exe
        
        C:\Windows\System32\EdYubHP.exe
        5⤵
        
        PID:17232
    - - C:\Windows\System32\VEQiUzh.exe
        
        C:\Windows\System32\VEQiUzh.exe
        5⤵
        
        PID:17252
    - - C:\Windows\System32\QMUKhmQ.exe
        
        C:\Windows\System32\QMUKhmQ.exe
        5⤵
        
        PID:17276
    - - C:\Windows\System32\WSUWKHr.exe
        
        C:\Windows\System32\WSUWKHr.exe
        5⤵
        
        PID:17300
    - - C:\Windows\System32\TTKoWhH.exe
        
        C:\Windows\System32\TTKoWhH.exe
        5⤵
        
        PID:17324
    - - C:\Windows\System32\qVZlmVt.exe
        
        C:\Windows\System32\qVZlmVt.exe
        5⤵
        
        PID:17344
  - - C:\Users\Admin\Downloads\240919-vb1tvazcrnfe02d8bd031828aa9a5a241b2e82bef8430eca143390de2df47700d2422475a8N.exe
      C:\Users\Admin\Downloads\240919-vb1tvazcrnfe02d8bd031828aa9a5a241b2e82bef8430eca143390de2df47700d2422475a8N.exe
      4⤵
      PID:5196
    - - C:\Windows\SysWOW64\Gdaociml.exe
        
        C:\Windows\system32\Gdaociml.exe
        5⤵
        
        PID:5620
      - C:\Windows\SysWOW64\Gipdap32.exe
        
        C:\Windows\system32\Gipdap32.exe
        6⤵
        
        PID:5832
        
        C:\Windows\SysWOW64\Hplicjok.exe
        
        C:\Windows\system32\Hplicjok.exe
        7⤵
        
        PID:5252
        
        C:\Windows\SysWOW64\Ipoopgnf.exe
        
        C:\Windows\system32\Ipoopgnf.exe
        8⤵
        
        PID:6848
        
        C:\Windows\SysWOW64\Jqhafffk.exe
        
        C:\Windows\system32\Jqhafffk.exe
        9⤵
        
        PID:7216
        
        C:\Windows\SysWOW64\Lmbhgd32.exe
        
        C:\Windows\system32\Lmbhgd32.exe
        10⤵
        
        PID:8716
  - - C:\Users\Admin\Downloads\240919-vmaf2azdkdebcd4ccc3a3594b43a2dabed8b1a9d5d_JaffaCakes118.exe
      C:\Users\Admin\Downloads\240919-vmaf2azdkdebcd4ccc3a3594b43a2dabed8b1a9d5d_JaffaCakes118.exe
      4⤵
      PID:684
    - - C:\Users\Admin\Downloads\240919-vmaf2azdkdebcd4ccc3a3594b43a2dabed8b1a9d5d_JaffaCakes118.exe
        
        "C:\Users\Admin\Downloads\240919-vmaf2azdkdebcd4ccc3a3594b43a2dabed8b1a9d5d_JaffaCakes118.exe"
        5⤵
        
        PID:10952
  - - C:\Users\Admin\Downloads\240919-vdnbjazdpj70c62f4f0f3a13513b7b259c4233d26a38cd350ab5160409ac7c5d0df458b95bN.exe
      C:\Users\Admin\Downloads\240919-vdnbjazdpj70c62f4f0f3a13513b7b259c4233d26a38cd350ab5160409ac7c5d0df458b95bN.exe
      4⤵
      PID:7072
    - - C:\Windows\SysWOW64\Kmieae32.exe
        
        C:\Windows\system32\Kmieae32.exe
        5⤵
        
        PID:3044
      - C:\Windows\SysWOW64\Lgepom32.exe
        
        C:\Windows\system32\Lgepom32.exe
        6⤵
        
        PID:8680
  - - C:\Users\Admin\Downloads\240919-t8b2bazbllebc2b31d5bb6d2099d7b9242c28a48a7_JaffaCakes118.exe
      C:\Users\Admin\Downloads\240919-t8b2bazbllebc2b31d5bb6d2099d7b9242c28a48a7_JaffaCakes118.exe
      4⤵
      PID:7084
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7084 -s 372
        5⤵
        Program crash
        
        PID:6300
  - - C:\Users\Admin\Downloads\240919-vhw48szbncebcaa9341c0ef64dd93640c3a6babdd7_JaffaCakes118.exe
      C:\Users\Admin\Downloads\240919-vhw48szbncebcaa9341c0ef64dd93640c3a6babdd7_JaffaCakes118.exe
      4⤵
      PID:6644
    - - C:\Windows\SysWOW64\wmplayer.exe
        
        C:\Windows\system32\wmplayer.exe
        5⤵
        
        PID:6176
  - - C:\Users\Admin\Downloads\240919-t7fywayera0f2b9a103dcffece0c409311c0a346bcbbcc399a4619092747290a492a9b8febN.exe
      C:\Users\Admin\Downloads\240919-t7fywayera0f2b9a103dcffece0c409311c0a346bcbbcc399a4619092747290a492a9b8febN.exe
      4⤵
      PID:6696
    - - C:\Windows\SysWOW64\Jpfepf32.exe
        
        C:\Windows\system32\Jpfepf32.exe
        5⤵
        
        PID:6748
      - C:\Windows\SysWOW64\Lkalplel.exe
        
        C:\Windows\system32\Lkalplel.exe
        6⤵
        
        PID:8744
  - - C:\Users\Admin\Downloads\240919-t9rhdsyfrfd30da22c7e0395f8287479ac83bd4480391b0c4f62bdad95edf909fd4d9f3396N.exe
      C:\Users\Admin\Downloads\240919-t9rhdsyfrfd30da22c7e0395f8287479ac83bd4480391b0c4f62bdad95edf909fd4d9f3396N.exe
      4⤵
      PID:7144
    - - C:\Windows\SysWOW64\Kmieae32.exe
        
        C:\Windows\system32\Kmieae32.exe
        5⤵
        
        PID:6296
      - C:\Windows\SysWOW64\Ndflak32.exe
        
        C:\Windows\system32\Ndflak32.exe
        6⤵
        
        PID:10252
  - - C:\Users\Admin\Downloads\240919-ve41nszalca11d557ee3b83326a9b02abe58dcd45cf6e974939e75e7906cc567c53c4a98faN.exe
      C:\Users\Admin\Downloads\240919-ve41nszalca11d557ee3b83326a9b02abe58dcd45cf6e974939e75e7906cc567c53c4a98faN.exe
      4⤵
      PID:8580
  - - C:\Users\Admin\Downloads\240919-t95d9aygkaQuotationpdf.exe
      C:\Users\Admin\Downloads\240919-t95d9aygkaQuotationpdf.exe
      4⤵
      PID:10444
  - - C:\Users\Admin\Downloads\240919-vkxtjszgln42460c541e22435209e2708f6f6fc2392633bb1da91330b59cf973d3c67a782bN.exe
      C:\Users\Admin\Downloads\240919-vkxtjszgln42460c541e22435209e2708f6f6fc2392633bb1da91330b59cf973d3c67a782bN.exe
      4⤵
      PID:10456
  - - C:\Users\Admin\Downloads\240919-t8qvgazbmmebc2de96a2e617b8985a3b7feb8ce80c_JaffaCakes118.exe
      C:\Users\Admin\Downloads\240919-t8qvgazbmmebc2de96a2e617b8985a3b7feb8ce80c_JaffaCakes118.exe
      4⤵
      PID:12724

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservice -s CDPSvc
1⤵
PID:4708

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localserviceandnoimpersonation -s SSDPSRV
1⤵
PID:4932

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -s WinHttpAutoProxySvc
1⤵
PID:3484

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:2668

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s wlidsvc
1⤵
PID:4444

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Create or Modify System Process

T1543

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Create or Modify System Process

T1543

Windows Service

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry