4e087433f3f78b95be3d2b9d356e7e1a01cf5ef8ba9a845c26b51f10f7792673

Analysis

max time kernel
109s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20250313-en
resource tags

arch:x64arch:x86image:win10v2004-20250313-enlocale:en-usos:windows10-2004-x64system
submitted
02/05/2025, 04:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2025-05-02_afe201bb75b834f9b30f2f2bc170332e_black-basta_elex_hijackloader_luca-stealer.exe
Size 9.4MB
Sample250502-fejx6sysa1
SHA256 4e087433f3f78b95be3d2b9d356e7e1a01cf5ef8ba9a845c26b51f10f7792673
MD5 afe201bb75b834f9b30f2f2bc170332e
SHA1 2bd0d8db872b405944d669c5508fbf5fb42a6f51
SHA512 af8f6f8b5e4445b476edb881a79bb6de40978c5c03b6dbcf176c61c40568c356558fd4f1469df098651bb8a7e64fb05cc3db007a88bc323934c7da1d74549874
SSDEEP 98304:AGyqWyWy0GyqWyWyMRPC1eHL5dGYSEYvZ:t1eHL5dEvZ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

defense_evasion discovery persistence ransomware trojan upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 12 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe"	2025-05-02_afe201bb75b834f9b30f2f2bc170332e_black-basta_elex_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe"	2025-05-02_afe201bb75b834f9b30f2f2bc170332e_black-basta_elex_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe"	system32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe"	Kazekage.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe"	Kazekage.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe"	Gaara.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe"	Gaara.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe"	system32.exe

Modifies visibility of file extensions in Explorer 2 TTPs 6 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	csrss.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	smss.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	Gaara.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	2025-05-02_afe201bb75b834f9b30f2f2bc170332e_black-basta_elex_hijackloader_luca-stealer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	system32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	Kazekage.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 6 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	2025-05-02_afe201bb75b834f9b30f2f2bc170332e_black-basta_elex_hijackloader_luca-stealer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	system32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	Kazekage.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	csrss.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	smss.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	Gaara.exe

UAC bypass 3 TTPs 6 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Kazekage.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	smss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Gaara.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2025-05-02_afe201bb75b834f9b30f2f2bc170332e_black-basta_elex_hijackloader_luca-stealer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	system32.exe

Disables RegEdit via registry modification 6 IoCs

defense_evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	smss.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	Gaara.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	2025-05-02_afe201bb75b834f9b30f2f2bc170332e_black-basta_elex_hijackloader_luca-stealer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	system32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	Kazekage.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	csrss.exe

Disables use of System Restore points 1 TTPs
defense_evasion

Inhibit System Recovery
T1490

Drops file in Drivers directory 24 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\system32.exe	smss.exe
File opened for modification	C:\Windows\SysWOW64\drivers\Kazekage.exe	2025-05-02_afe201bb75b834f9b30f2f2bc170332e_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	C:\Windows\SysWOW64\drivers\Kazekage.exe	smss.exe
File opened for modification	C:\Windows\SysWOW64\drivers\system32.exe	smss.exe
File opened for modification	C:\Windows\SysWOW64\drivers\Kazekage.exe	csrss.exe
File opened for modification	C:\Windows\SysWOW64\drivers\Kazekage.exe	Kazekage.exe
File created	C:\Windows\SysWOW64\drivers\system32.exe	Kazekage.exe
File opened for modification	C:\Windows\SysWOW64\drivers\system32.exe	Kazekage.exe
File created	C:\Windows\SysWOW64\drivers\system32.exe	system32.exe
File opened for modification	C:\Windows\SysWOW64\drivers\system32.exe	2025-05-02_afe201bb75b834f9b30f2f2bc170332e_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	C:\Windows\SysWOW64\drivers\Kazekage.exe	Gaara.exe
File opened for modification	C:\Windows\SysWOW64\drivers\system32.exe	csrss.exe
File created	C:\Windows\SysWOW64\drivers\Kazekage.exe	Kazekage.exe
File created	C:\Windows\SysWOW64\drivers\Kazekage.exe	system32.exe
File created	C:\Windows\SysWOW64\drivers\Kazekage.exe	smss.exe
File created	C:\Windows\SysWOW64\drivers\system32.exe	Gaara.exe
File created	C:\Windows\SysWOW64\drivers\Kazekage.exe	csrss.exe
File opened for modification	C:\Windows\SysWOW64\drivers\Kazekage.exe	system32.exe
File created	C:\Windows\SysWOW64\drivers\Kazekage.exe	Gaara.exe
File created	C:\Windows\SysWOW64\drivers\system32.exe	csrss.exe
File created	C:\Windows\SysWOW64\drivers\Kazekage.exe	2025-05-02_afe201bb75b834f9b30f2f2bc170332e_black-basta_elex_hijackloader_luca-stealer.exe
File created	C:\Windows\SysWOW64\drivers\system32.exe	2025-05-02_afe201bb75b834f9b30f2f2bc170332e_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	C:\Windows\SysWOW64\drivers\system32.exe	Gaara.exe
File opened for modification	C:\Windows\SysWOW64\drivers\system32.exe	system32.exe

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 64 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Thumbs.com\Debugger = "cmd.exe /c del"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Obito.exe\Debugger = "cmd.exe /c del"	Kazekage.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedt32.exe\Debugger = "drivers\\Kazekage.exe"	Kazekage.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspoold.exe\Debugger = "cmd.exe /c del"	system32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspool.exe\Debugger = "cmd.exe /c del"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe\Debugger = "drivers\\Kazekage.exe"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe\Debugger = "drivers\\Kazekage.exe"	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe	Gaara.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe	system32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HOKAGE4.exe\Debugger = "cmd.exe /c del"	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe	Gaara.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Obito.exe\Debugger = "cmd.exe /c del"	Gaara.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Obito.exe	Gaara.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	Kazekage.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe\Debugger = "drivers\\Kazekage.exe"	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedt32.exe	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HOKAGE4.exe	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "drivers\\Kazekage.exe"	2025-05-02_afe201bb75b834f9b30f2f2bc170332e_black-basta_elex_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KakashiHatake.exe\Debugger = "cmd.exe /c del"	system32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.avi.exe\Debugger = "cmd.exe /c del"	Kazekage.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "drivers\\Kazekage.exe"	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.exe	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.avi.exe	Gaara.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe\Debugger = "drivers\\Kazekage.exe"	2025-05-02_afe201bb75b834f9b30f2f2bc170332e_black-basta_elex_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe\Debugger = "drivers\\Kazekage.exe"	2025-05-02_afe201bb75b834f9b30f2f2bc170332e_black-basta_elex_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KakashiHatake.exe\Debugger = "cmd.exe /c del"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe\Debugger = "drivers\\Kazekage.exe"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspool.exe\Debugger = "cmd.exe /c del"	Gaara.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HOKAGE4.exe	2025-05-02_afe201bb75b834f9b30f2f2bc170332e_black-basta_elex_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe\Debugger = "drivers\\Kazekage.exe"	system32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspool.exe\Debugger = "cmd.exe /c del"	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	2025-05-02_afe201bb75b834f9b30f2f2bc170332e_black-basta_elex_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe\Debugger = "drivers\\Kazekage.exe"	Kazekage.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KakashiHatake.exe\Debugger = "cmd.exe /c del"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Obito.exe\Debugger = "cmd.exe /c del"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HokageFile.exe\Debugger = "cmd.exe /c del"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "drivers\\Kazekage.exe"	Gaara.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe	system32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe	system32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "drivers\\Kazekage.exe"	Kazekage.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedt32.exe	Kazekage.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe\Debugger = "drivers\\Kazekage.exe"	Kazekage.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HokageFile.exe	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe\Debugger = "drivers\\Kazekage.exe"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe\Debugger = "drivers\\Kazekage.exe"	Gaara.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "drivers\\Kazekage.exe"	system32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rin.exe	Kazekage.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "drivers\\Kazekage.exe"	2025-05-02_afe201bb75b834f9b30f2f2bc170332e_black-basta_elex_hijackloader_luca-stealer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe	Gaara.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Thumbs.com	Gaara.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedt32.exe	Gaara.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KakashiHatake.exe	Gaara.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rin.exe	2025-05-02_afe201bb75b834f9b30f2f2bc170332e_black-basta_elex_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe\Debugger = "drivers\\Kazekage.exe"	Kazekage.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KakashiHatake.exe	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe\Debugger = "drivers\\Kazekage.exe"	2025-05-02_afe201bb75b834f9b30f2f2bc170332e_black-basta_elex_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedt32.exe\Debugger = "drivers\\Kazekage.exe"	system32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KakashiHatake.exe	smss.exe

Executes dropped EXE 30 IoCs

pid	Process
1484	smss.exe
4344	smss.exe
6012	Gaara.exe
4684	smss.exe
4568	Gaara.exe
5140	csrss.exe
448	smss.exe
1472	Gaara.exe
4968	Gaara.exe
3552	csrss.exe
1908	csrss.exe
920	csrss.exe
2892	Kazekage.exe
2576	Kazekage.exe
1308	Kazekage.exe
5940	smss.exe
2632	system32.exe
2260	system32.exe
1088	Kazekage.exe
4228	smss.exe
3948	Gaara.exe
3752	system32.exe
3312	Gaara.exe
3540	csrss.exe
2296	csrss.exe
624	Kazekage.exe
5560	Kazekage.exe
2180	system32.exe
2300	system32.exe
4064	system32.exe

Loads dropped DLL 18 IoCs

pid	Process
1484	smss.exe
4344	smss.exe
6012	Gaara.exe
4684	smss.exe
4568	Gaara.exe
5140	csrss.exe
448	smss.exe
1472	Gaara.exe
4968	Gaara.exe
3552	csrss.exe
1908	csrss.exe
920	csrss.exe
5940	smss.exe
4228	smss.exe
3948	Gaara.exe
3312	Gaara.exe
3540	csrss.exe
2296	csrss.exe

Adds Run key to start application 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 2 - 5 - 2025\\Gaara.exe"	system32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 2 - 5 - 2025\\smss.exe"	Kazekage.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe"	Kazekage.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 2 - 5 - 2025\\smss.exe"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "2-5-2025.exe"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 2 - 5 - 2025\\Gaara.exe"	Gaara.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "2-5-2025.exe"	Gaara.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "2-5-2025.exe"	2025-05-02_afe201bb75b834f9b30f2f2bc170332e_black-basta_elex_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "2-5-2025.exe"	Kazekage.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe"	Gaara.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 2 - 5 - 2025\\smss.exe"	2025-05-02_afe201bb75b834f9b30f2f2bc170332e_black-basta_elex_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 2 - 5 - 2025\\Gaara.exe"	2025-05-02_afe201bb75b834f9b30f2f2bc170332e_black-basta_elex_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 2 - 5 - 2025\\smss.exe"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 2 - 5 - 2025\\Gaara.exe"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "2-5-2025.exe"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 2 - 5 - 2025\\smss.exe"	Gaara.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe"	2025-05-02_afe201bb75b834f9b30f2f2bc170332e_black-basta_elex_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 2 - 5 - 2025\\smss.exe"	system32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "2-5-2025.exe"	system32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe"	system32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 2 - 5 - 2025\\Gaara.exe"	Kazekage.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 2 - 5 - 2025\\Gaara.exe"	smss.exe

Checks whether UAC is enabled 1 TTPs 6 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	smss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Gaara.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2025-05-02_afe201bb75b834f9b30f2f2bc170332e_black-basta_elex_hijackloader_luca-stealer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	system32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Kazekage.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe

Drops desktop.ini file(s) 64 IoCs

description	ioc	Process
File opened for modification	\??\S:\Desktop.ini	Gaara.exe
File opened for modification	\??\T:\Desktop.ini	Gaara.exe
File opened for modification	\??\L:\Desktop.ini	system32.exe
File opened for modification	\??\Q:\Desktop.ini	system32.exe
File opened for modification	\??\E:\Desktop.ini	Gaara.exe
File opened for modification	\??\J:\Desktop.ini	Gaara.exe
File opened for modification	\??\L:\Desktop.ini	Gaara.exe
File opened for modification	\??\T:\Desktop.ini	2025-05-02_afe201bb75b834f9b30f2f2bc170332e_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	\??\U:\Desktop.ini	2025-05-02_afe201bb75b834f9b30f2f2bc170332e_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	\??\M:\Desktop.ini	system32.exe
File opened for modification	\??\U:\Desktop.ini	system32.exe
File opened for modification	\??\X:\Desktop.ini	system32.exe
File opened for modification	D:\Desktop.ini	smss.exe
File opened for modification	\??\K:\Desktop.ini	smss.exe
File opened for modification	\??\G:\Desktop.ini	2025-05-02_afe201bb75b834f9b30f2f2bc170332e_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	D:\Desktop.ini	system32.exe
File opened for modification	\??\J:\Desktop.ini	system32.exe
File opened for modification	\??\W:\Desktop.ini	system32.exe
File opened for modification	\??\X:\Desktop.ini	Kazekage.exe
File opened for modification	\??\B:\Desktop.ini	csrss.exe
File opened for modification	\??\O:\Desktop.ini	Gaara.exe
File opened for modification	\??\Z:\Desktop.ini	Gaara.exe
File opened for modification	F:\Desktop.ini	2025-05-02_afe201bb75b834f9b30f2f2bc170332e_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	\??\W:\Desktop.ini	Kazekage.exe
File opened for modification	\??\A:\Desktop.ini	csrss.exe
File opened for modification	\??\H:\Desktop.ini	smss.exe
File opened for modification	\??\J:\Desktop.ini	smss.exe
File opened for modification	\??\Y:\Desktop.ini	smss.exe
File opened for modification	\??\P:\Desktop.ini	smss.exe
File opened for modification	\??\I:\Desktop.ini	system32.exe
File opened for modification	\??\N:\Desktop.ini	system32.exe
File opened for modification	\??\Y:\Desktop.ini	system32.exe
File opened for modification	\??\Z:\Desktop.ini	system32.exe
File opened for modification	\??\H:\Desktop.ini	Kazekage.exe
File opened for modification	\??\T:\Desktop.ini	Kazekage.exe
File opened for modification	\??\I:\Desktop.ini	csrss.exe
File opened for modification	\??\M:\Desktop.ini	2025-05-02_afe201bb75b834f9b30f2f2bc170332e_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	\??\R:\Desktop.ini	2025-05-02_afe201bb75b834f9b30f2f2bc170332e_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	\??\P:\Desktop.ini	system32.exe
File opened for modification	C:\Desktop.ini	Kazekage.exe
File opened for modification	\??\H:\Desktop.ini	system32.exe
File opened for modification	\??\B:\Desktop.ini	Kazekage.exe
File opened for modification	\??\R:\Desktop.ini	csrss.exe
File opened for modification	\??\W:\Desktop.ini	csrss.exe
File opened for modification	\??\Z:\Desktop.ini	csrss.exe
File opened for modification	\??\V:\Desktop.ini	smss.exe
File opened for modification	\??\H:\Desktop.ini	Gaara.exe
File opened for modification	\??\Q:\Desktop.ini	Gaara.exe
File opened for modification	\??\R:\Desktop.ini	system32.exe
File opened for modification	C:\Desktop.ini	csrss.exe
File opened for modification	\??\U:\Desktop.ini	csrss.exe
File opened for modification	F:\Desktop.ini	smss.exe
File opened for modification	\??\N:\Desktop.ini	Kazekage.exe
File opened for modification	\??\M:\Desktop.ini	csrss.exe
File opened for modification	\??\N:\Desktop.ini	smss.exe
File opened for modification	\??\G:\Desktop.ini	smss.exe
File opened for modification	\??\R:\Desktop.ini	smss.exe
File opened for modification	\??\X:\Desktop.ini	smss.exe
File opened for modification	D:\Desktop.ini	Gaara.exe
File opened for modification	\??\I:\Desktop.ini	Gaara.exe
File opened for modification	\??\N:\Desktop.ini	Gaara.exe
File opened for modification	\??\Y:\Desktop.ini	Kazekage.exe
File opened for modification	D:\Desktop.ini	2025-05-02_afe201bb75b834f9b30f2f2bc170332e_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	\??\W:\Desktop.ini	smss.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\T:	csrss.exe
File opened (read-only)	\??\O:	2025-05-02_afe201bb75b834f9b30f2f2bc170332e_black-basta_elex_hijackloader_luca-stealer.exe
File opened (read-only)	\??\Y:	system32.exe
File opened (read-only)	\??\B:	Kazekage.exe
File opened (read-only)	\??\I:	Kazekage.exe
File opened (read-only)	\??\Q:	Kazekage.exe
File opened (read-only)	\??\A:	csrss.exe
File opened (read-only)	\??\W:	csrss.exe
File opened (read-only)	\??\Y:	csrss.exe
File opened (read-only)	\??\L:	2025-05-02_afe201bb75b834f9b30f2f2bc170332e_black-basta_elex_hijackloader_luca-stealer.exe
File opened (read-only)	\??\A:	smss.exe
File opened (read-only)	\??\V:	smss.exe
File opened (read-only)	\??\J:	Gaara.exe
File opened (read-only)	\??\T:	Gaara.exe
File opened (read-only)	\??\U:	Gaara.exe
File opened (read-only)	\??\O:	system32.exe
File opened (read-only)	\??\V:	Kazekage.exe
File opened (read-only)	\??\Y:	smss.exe
File opened (read-only)	\??\E:	2025-05-02_afe201bb75b834f9b30f2f2bc170332e_black-basta_elex_hijackloader_luca-stealer.exe
File opened (read-only)	\??\G:	system32.exe
File opened (read-only)	\??\Z:	system32.exe
File opened (read-only)	\??\K:	2025-05-02_afe201bb75b834f9b30f2f2bc170332e_black-basta_elex_hijackloader_luca-stealer.exe
File opened (read-only)	\??\H:	system32.exe
File opened (read-only)	\??\T:	system32.exe
File opened (read-only)	\??\V:	system32.exe
File opened (read-only)	\??\X:	system32.exe
File opened (read-only)	\??\Y:	Kazekage.exe
File opened (read-only)	\??\X:	csrss.exe
File opened (read-only)	\??\K:	smss.exe
File opened (read-only)	\??\P:	smss.exe
File opened (read-only)	\??\T:	smss.exe
File opened (read-only)	\??\V:	2025-05-02_afe201bb75b834f9b30f2f2bc170332e_black-basta_elex_hijackloader_luca-stealer.exe
File opened (read-only)	\??\K:	Kazekage.exe
File opened (read-only)	\??\G:	smss.exe
File opened (read-only)	\??\P:	Gaara.exe
File opened (read-only)	\??\M:	system32.exe
File opened (read-only)	\??\S:	system32.exe
File opened (read-only)	\??\G:	Kazekage.exe
File opened (read-only)	\??\P:	Kazekage.exe
File opened (read-only)	\??\Q:	csrss.exe
File opened (read-only)	\??\A:	system32.exe
File opened (read-only)	\??\R:	system32.exe
File opened (read-only)	\??\S:	Kazekage.exe
File opened (read-only)	\??\U:	Kazekage.exe
File opened (read-only)	\??\H:	smss.exe
File opened (read-only)	\??\E:	csrss.exe
File opened (read-only)	\??\X:	smss.exe
File opened (read-only)	\??\I:	Gaara.exe
File opened (read-only)	\??\B:	2025-05-02_afe201bb75b834f9b30f2f2bc170332e_black-basta_elex_hijackloader_luca-stealer.exe
File opened (read-only)	\??\U:	2025-05-02_afe201bb75b834f9b30f2f2bc170332e_black-basta_elex_hijackloader_luca-stealer.exe
File opened (read-only)	\??\L:	system32.exe
File opened (read-only)	\??\U:	system32.exe
File opened (read-only)	\??\P:	csrss.exe
File opened (read-only)	\??\V:	csrss.exe
File opened (read-only)	\??\N:	smss.exe
File opened (read-only)	\??\H:	Gaara.exe
File opened (read-only)	\??\O:	Gaara.exe
File opened (read-only)	\??\X:	Gaara.exe
File opened (read-only)	\??\Z:	Kazekage.exe
File opened (read-only)	\??\A:	Gaara.exe
File opened (read-only)	\??\J:	2025-05-02_afe201bb75b834f9b30f2f2bc170332e_black-basta_elex_hijackloader_luca-stealer.exe
File opened (read-only)	\??\E:	system32.exe
File opened (read-only)	\??\O:	smss.exe
File opened (read-only)	\??\W:	system32.exe

Drops autorun.inf file 1 TTPs 64 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File created	D:\Autorun.inf	2025-05-02_afe201bb75b834f9b30f2f2bc170332e_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	\??\L:\Autorun.inf	Kazekage.exe
File opened for modification	\??\L:\Autorun.inf	system32.exe
File created	\??\S:\Autorun.inf	Gaara.exe
File opened for modification	\??\Q:\Autorun.inf	Kazekage.exe
File opened for modification	\??\T:\Autorun.inf	Kazekage.exe
File opened for modification	\??\G:\Autorun.inf	system32.exe
File created	\??\U:\Autorun.inf	system32.exe
File created	\??\E:\Autorun.inf	Gaara.exe
File created	\??\M:\Autorun.inf	smss.exe
File opened for modification	\??\E:\Autorun.inf	Gaara.exe
File created	\??\G:\Autorun.inf	Gaara.exe
File opened for modification	\??\O:\Autorun.inf	system32.exe
File opened for modification	\??\P:\Autorun.inf	system32.exe
File opened for modification	\??\R:\Autorun.inf	2025-05-02_afe201bb75b834f9b30f2f2bc170332e_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	\??\A:\Autorun.inf	smss.exe
File created	\??\R:\Autorun.inf	system32.exe
File created	\??\I:\Autorun.inf	smss.exe
File opened for modification	\??\V:\Autorun.inf	Kazekage.exe
File opened for modification	\??\U:\Autorun.inf	system32.exe
File created	\??\O:\Autorun.inf	2025-05-02_afe201bb75b834f9b30f2f2bc170332e_black-basta_elex_hijackloader_luca-stealer.exe
File created	\??\L:\Autorun.inf	smss.exe
File opened for modification	\??\Q:\Autorun.inf	smss.exe
File opened for modification	\??\M:\Autorun.inf	Gaara.exe
File created	\??\S:\Autorun.inf	csrss.exe
File created	\??\M:\Autorun.inf	system32.exe
File opened for modification	\??\K:\Autorun.inf	csrss.exe
File created	\??\G:\Autorun.inf	Kazekage.exe
File opened for modification	\??\H:\Autorun.inf	system32.exe
File created	\??\Q:\Autorun.inf	Gaara.exe
File opened for modification	\??\Z:\Autorun.inf	csrss.exe
File created	\??\J:\Autorun.inf	2025-05-02_afe201bb75b834f9b30f2f2bc170332e_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	F:\Autorun.inf	smss.exe
File opened for modification	\??\S:\Autorun.inf	Gaara.exe
File created	\??\U:\Autorun.inf	Gaara.exe
File opened for modification	\??\V:\Autorun.inf	Gaara.exe
File created	\??\W:\Autorun.inf	Gaara.exe
File opened for modification	\??\G:\Autorun.inf	csrss.exe
File created	\??\A:\Autorun.inf	system32.exe
File created	\??\Y:\Autorun.inf	2025-05-02_afe201bb75b834f9b30f2f2bc170332e_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	D:\Autorun.inf	smss.exe
File opened for modification	F:\Autorun.inf	Kazekage.exe
File opened for modification	\??\B:\Autorun.inf	system32.exe
File created	\??\Z:\Autorun.inf	system32.exe
File opened for modification	D:\Autorun.inf	Kazekage.exe
File opened for modification	\??\E:\Autorun.inf	Kazekage.exe
File opened for modification	\??\R:\Autorun.inf	Kazekage.exe
File opened for modification	\??\W:\Autorun.inf	Kazekage.exe
File created	\??\V:\Autorun.inf	system32.exe
File created	\??\Z:\Autorun.inf	2025-05-02_afe201bb75b834f9b30f2f2bc170332e_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	\??\H:\Autorun.inf	Gaara.exe
File opened for modification	\??\Z:\Autorun.inf	Gaara.exe
File created	\??\Z:\Autorun.inf	csrss.exe
File created	\??\R:\Autorun.inf	Kazekage.exe
File opened for modification	\??\E:\Autorun.inf	system32.exe
File opened for modification	\??\N:\Autorun.inf	Gaara.exe
File opened for modification	\??\J:\Autorun.inf	csrss.exe
File created	\??\K:\Autorun.inf	csrss.exe
File opened for modification	\??\A:\Autorun.inf	Kazekage.exe
File created	\??\P:\Autorun.inf	Kazekage.exe
File created	\??\V:\Autorun.inf	Gaara.exe
File created	\??\J:\Autorun.inf	csrss.exe
File opened for modification	\??\Y:\Autorun.inf	csrss.exe
File created	\??\J:\Autorun.inf	Kazekage.exe

Drops file in System32 directory 39 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\msvbvm60.dll	Gaara.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	smss.exe
File opened for modification	C:\Windows\SysWOW64\mscomctl.ocx	Gaara.exe
File opened for modification	C:\Windows\SysWOW64\2-5-2025.exe	Gaara.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	csrss.exe
File opened for modification	C:\Windows\SysWOW64\2-5-2025.exe	system32.exe
File opened for modification	C:\Windows\SysWOW64\Desktop.ini	smss.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	system32.exe
File created	C:\Windows\SysWOW64\2-5-2025.exe	2025-05-02_afe201bb75b834f9b30f2f2bc170332e_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	C:\Windows\SysWOW64\2-5-2025.exe	smss.exe
File opened for modification	C:\Windows\SysWOW64\Desktop.ini	2025-05-02_afe201bb75b834f9b30f2f2bc170332e_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	C:\Windows\SysWOW64\	2025-05-02_afe201bb75b834f9b30f2f2bc170332e_black-basta_elex_hijackloader_luca-stealer.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	2025-05-02_afe201bb75b834f9b30f2f2bc170332e_black-basta_elex_hijackloader_luca-stealer.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	smss.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	2025-05-02_afe201bb75b834f9b30f2f2bc170332e_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	C:\Windows\SysWOW64\	smss.exe
File opened for modification	C:\Windows\SysWOW64\Desktop.ini	Gaara.exe
File opened for modification	C:\Windows\SysWOW64\mscomctl.ocx	csrss.exe
File opened for modification	C:\Windows\SysWOW64\Desktop.ini	system32.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	Kazekage.exe
File opened for modification	C:\Windows\SysWOW64\	Gaara.exe
File opened for modification	C:\Windows\SysWOW64\	csrss.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	csrss.exe
File opened for modification	C:\Windows\SysWOW64\2-5-2025.exe	2025-05-02_afe201bb75b834f9b30f2f2bc170332e_black-basta_elex_hijackloader_luca-stealer.exe
File created	C:\Windows\SysWOW64\mscomctl.ocx	2025-05-02_afe201bb75b834f9b30f2f2bc170332e_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	C:\Windows\SysWOW64\mscomctl.ocx	2025-05-02_afe201bb75b834f9b30f2f2bc170332e_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	C:\Windows\SysWOW64\mscomctl.ocx	smss.exe
File opened for modification	C:\Windows\SysWOW64\2-5-2025.exe	csrss.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	system32.exe
File created	C:\Windows\SysWOW64\Desktop.ini	2025-05-02_afe201bb75b834f9b30f2f2bc170332e_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	C:\Windows\SysWOW64\Desktop.ini	Kazekage.exe
File opened for modification	C:\Windows\SysWOW64\mscomctl.ocx	Kazekage.exe
File opened for modification	C:\Windows\SysWOW64\	Kazekage.exe
File opened for modification	C:\Windows\SysWOW64\	system32.exe
File opened for modification	C:\Windows\SysWOW64\2-5-2025.exe	Kazekage.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	Gaara.exe
File opened for modification	C:\Windows\SysWOW64\Desktop.ini	csrss.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	Kazekage.exe
File opened for modification	C:\Windows\SysWOW64\mscomctl.ocx	system32.exe

Sets desktop wallpaper using registry 2 TTPs 6 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg"	smss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg"	Gaara.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg"	csrss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg"	Kazekage.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg"	system32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg"	2025-05-02_afe201bb75b834f9b30f2f2bc170332e_black-basta_elex_hijackloader_luca-stealer.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2064-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/files/0x000700000002421d-11.dat	upx
behavioral1/files/0x000700000002421a-31.dat	upx
behavioral1/memory/1484-32-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/files/0x000700000002421c-41.dat	upx
behavioral1/files/0x000700000002421e-49.dat	upx
behavioral1/files/0x0007000000024220-57.dat	upx
behavioral1/memory/4344-70-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/6012-79-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/4344-78-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/files/0x000700000002421e-89.dat	upx
behavioral1/files/0x000700000002421f-93.dat	upx
behavioral1/files/0x0007000000024220-97.dat	upx
behavioral1/files/0x000700000002421d-85.dat	upx
behavioral1/files/0x000700000002421f-53.dat	upx
behavioral1/memory/4568-114-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/4568-119-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/5140-122-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2064-127-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/files/0x000700000002421e-131.dat	upx
behavioral1/files/0x000700000002421f-135.dat	upx
behavioral1/files/0x0007000000024220-140.dat	upx
behavioral1/memory/1484-152-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/6012-161-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/1908-173-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/1472-177-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/4968-175-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/3552-172-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/5140-183-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/1908-189-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/920-198-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2892-194-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/files/0x000700000002421e-209.dat	upx
behavioral1/memory/2576-226-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/1308-224-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2260-231-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2632-229-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/1088-240-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2892-239-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2260-258-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/1088-263-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/4228-268-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/3752-271-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2632-279-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/3312-275-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/1484-277-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/3948-273-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2180-291-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/624-293-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/5560-297-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2300-305-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2180-303-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/4064-306-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/6012-307-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2892-308-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2632-309-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/5140-310-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2064-311-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/1484-312-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2892-314-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/files/0x0001000000000032-421.dat	upx
behavioral1/memory/2064-495-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/1484-496-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/6012-497-0x0000000000400000-0x000000000042A000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\msvbvm60.dll	system32.exe
File opened for modification	C:\Windows\	Gaara.exe
File created	C:\Windows\Fonts\Admin 2 - 5 - 2025\smss.exe	smss.exe
File opened for modification	C:\Windows\Fonts\Admin 2 - 5 - 2025\Gaara.exe	smss.exe
File opened for modification	C:\Windows\Fonts\The Kazekage.jpg	csrss.exe
File opened for modification	C:\Windows\system\msvbvm60.dll	system32.exe
File opened for modification	C:\Windows\system\msvbvm60.dll	2025-05-02_afe201bb75b834f9b30f2f2bc170332e_black-basta_elex_hijackloader_luca-stealer.exe
File created	C:\Windows\WBEM\msvbvm60.dll	2025-05-02_afe201bb75b834f9b30f2f2bc170332e_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	C:\Windows\Fonts\Admin 2 - 5 - 2025\csrss.exe	Gaara.exe
File opened for modification	C:\Windows\system\mscoree.dll	Kazekage.exe
File opened for modification	C:\Windows\Fonts\The Kazekage.jpg	system32.exe
File created	C:\Windows\WBEM\msvbvm60.dll	smss.exe
File created	C:\Windows\Fonts\Admin 2 - 5 - 2025\msvbvm60.dll	csrss.exe
File created	C:\Windows\Fonts\Admin 2 - 5 - 2025\smss.exe	system32.exe
File opened for modification	C:\Windows\	csrss.exe
File opened for modification	C:\Windows\system\msvbvm60.dll	smss.exe
File opened for modification	C:\Windows\Fonts\The Kazekage.jpg	Gaara.exe
File created	C:\Windows\Fonts\Admin 2 - 5 - 2025\smss.exe	2025-05-02_afe201bb75b834f9b30f2f2bc170332e_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	C:\Windows\msvbvm60.dll	smss.exe
File opened for modification	C:\Windows\Fonts\Admin 2 - 5 - 2025\smss.exe	Gaara.exe
File created	C:\Windows\Fonts\Admin 2 - 5 - 2025\msvbvm60.dll	Kazekage.exe
File created	C:\Windows\Fonts\Admin 2 - 5 - 2025\Gaara.exe	system32.exe
File created	C:\Windows\msvbvm60.dll	2025-05-02_afe201bb75b834f9b30f2f2bc170332e_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	C:\Windows\msvbvm60.dll	2025-05-02_afe201bb75b834f9b30f2f2bc170332e_black-basta_elex_hijackloader_luca-stealer.exe
File created	C:\Windows\Fonts\Admin 2 - 5 - 2025\msvbvm60.dll	smss.exe
File created	C:\Windows\Fonts\Admin 2 - 5 - 2025\smss.exe	Gaara.exe
File opened for modification	C:\Windows\Fonts\Admin 2 - 5 - 2025\Gaara.exe	system32.exe
File created	C:\Windows\mscomctl.ocx	2025-05-02_afe201bb75b834f9b30f2f2bc170332e_black-basta_elex_hijackloader_luca-stealer.exe
File created	C:\Windows\Fonts\Admin 2 - 5 - 2025\msvbvm60.dll	2025-05-02_afe201bb75b834f9b30f2f2bc170332e_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	C:\Windows\Fonts\Admin 2 - 5 - 2025\csrss.exe	smss.exe
File opened for modification	C:\Windows\Fonts\Admin 2 - 5 - 2025\csrss.exe	csrss.exe
File opened for modification	C:\Windows\msvbvm60.dll	Kazekage.exe
File opened for modification	C:\Windows\mscomctl.ocx	Gaara.exe
File created	C:\Windows\WBEM\msvbvm60.dll	Gaara.exe
File opened for modification	C:\Windows\Fonts\Admin 2 - 5 - 2025\Gaara.exe	csrss.exe
File created	C:\Windows\Fonts\Admin 2 - 5 - 2025\Gaara.exe	smss.exe
File created	C:\Windows\Fonts\Admin 2 - 5 - 2025\smss.exe	csrss.exe
File opened for modification	C:\Windows\Fonts\The Kazekage.jpg	Kazekage.exe
File created	C:\Windows\Fonts\Admin 2 - 5 - 2025\csrss.exe	smss.exe
File opened for modification	C:\Windows\mscomctl.ocx	csrss.exe
File created	C:\Windows\Fonts\The Kazekage.jpg	2025-05-02_afe201bb75b834f9b30f2f2bc170332e_black-basta_elex_hijackloader_luca-stealer.exe
File created	C:\Windows\Fonts\Admin 2 - 5 - 2025\csrss.exe	2025-05-02_afe201bb75b834f9b30f2f2bc170332e_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	C:\Windows\Fonts\Admin 2 - 5 - 2025\smss.exe	csrss.exe
File created	C:\Windows\WBEM\msvbvm60.dll	csrss.exe
File created	C:\Windows\Fonts\Admin 2 - 5 - 2025\smss.exe	Kazekage.exe
File opened for modification	C:\Windows\Fonts\Admin 2 - 5 - 2025\csrss.exe	Kazekage.exe
File opened for modification	C:\Windows\	2025-05-02_afe201bb75b834f9b30f2f2bc170332e_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	C:\Windows\mscomctl.ocx	system32.exe
File opened for modification	C:\Windows\Fonts\The Kazekage.jpg	2025-05-02_afe201bb75b834f9b30f2f2bc170332e_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	C:\Windows\Fonts\Admin 2 - 5 - 2025\smss.exe	smss.exe
File opened for modification	C:\Windows\Fonts\Admin 2 - 5 - 2025\smss.exe	system32.exe
File created	C:\Windows\Fonts\Admin 2 - 5 - 2025\csrss.exe	system32.exe
File opened for modification	C:\Windows\Fonts\Admin 2 - 5 - 2025\smss.exe	2025-05-02_afe201bb75b834f9b30f2f2bc170332e_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	C:\Windows\system\msvbvm60.dll	csrss.exe
File opened for modification	C:\Windows\Fonts\Admin 2 - 5 - 2025\smss.exe	Kazekage.exe
File created	C:\Windows\Fonts\Admin 2 - 5 - 2025\Gaara.exe	Kazekage.exe
File opened for modification	C:\Windows\mscomctl.ocx	2025-05-02_afe201bb75b834f9b30f2f2bc170332e_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	C:\Windows\mscomctl.ocx	smss.exe
File opened for modification	C:\Windows\	smss.exe
File opened for modification	C:\Windows\	system32.exe
File opened for modification	C:\Windows\Fonts\Admin 2 - 5 - 2025\csrss.exe	2025-05-02_afe201bb75b834f9b30f2f2bc170332e_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	C:\Windows\Fonts\Admin 2 - 5 - 2025\msvbvm60.dll	2025-05-02_afe201bb75b834f9b30f2f2bc170332e_black-basta_elex_hijackloader_luca-stealer.exe
File opened for modification	C:\Windows\system\mscoree.dll	smss.exe
File opened for modification	C:\Windows\Fonts\Admin 2 - 5 - 2025\Gaara.exe	Kazekage.exe

System Location Discovery: System Language Discovery 1 TTPs 53 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kazekage.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gaara.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gaara.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2025-05-02_afe201bb75b834f9b30f2f2bc170332e_black-basta_elex_hijackloader_luca-stealer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gaara.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gaara.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kazekage.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kazekage.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gaara.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kazekage.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kazekage.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gaara.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kazekage.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 34 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4848	ping.exe
4856	ping.exe
3196	ping.exe
1632	ping.exe
5364	ping.exe
2112	ping.exe
1376	ping.exe
5980	ping.exe
1796	ping.exe
5584	ping.exe
4840	ping.exe
2992	ping.exe
5964	ping.exe
5372	ping.exe
1552	ping.exe
5380	ping.exe
4380	ping.exe
2576	ping.exe
5072	ping.exe
980	ping.exe
4344	ping.exe
1844	ping.exe
3984	ping.exe
1728	ping.exe
2960	ping.exe
4528	ping.exe
5212	ping.exe
2976	ping.exe
5464	ping.exe
4104	ping.exe
4656	ping.exe
5628	ping.exe
5844	ping.exe
5172	ping.exe

Modifies Control Panel 64 IoCs

defense_evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\Control Panel\Desktop\WallpaperStyle = "2"	2025-05-02_afe201bb75b834f9b30f2f2bc170332e_black-basta_elex_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\Control Panel\Desktop\ConvertedWallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg"	Gaara.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\Control Panel\Screen Saver.Marquee\Mode.EXE = "1"	2025-05-02_afe201bb75b834f9b30f2f2bc170332e_black-basta_elex_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\Control Panel\Screen Saver.Marquee\Font = "Blackadder ITC"	system32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\Control Panel\Screen Saver.Marquee\Mode.EXE = "1"	system32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\Control Panel\Screen Saver.Marquee\Speed = "4"	Kazekage.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\Control Panel\Desktop\ConvertedWallpaper = "Fonts\\The Kazekage.jpg"	Gaara.exe
Key created	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\Control Panel\Screen Saver.Marquee	2025-05-02_afe201bb75b834f9b30f2f2bc170332e_black-basta_elex_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\Control Panel\Screen Saver.Marquee\BackgroundColor = "0 0 0"	2025-05-02_afe201bb75b834f9b30f2f2bc170332e_black-basta_elex_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\Control Panel\Desktop\SCRNSAVE.EXE = "ssmarque.scr"	system32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\Control Panel\Desktop\ScreenSaveTimeOut = "400"	system32.exe
Key created	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\Control Panel\Desktop	smss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\Control Panel\Screen Saver.Marquee\BackgroundColor = "0 0 0"	smss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\Control Panel\Desktop\ConvertedWallpaper = "Fonts\\The Kazekage.jpg"	system32.exe
Key created	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\Control Panel\Screen Saver.Marquee	csrss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\Control Panel\Desktop\ConvertedWallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg"	smss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\Control Panel\Desktop\WallpaperStyle = "2"	Gaara.exe
Key created	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\Control Panel\Desktop	csrss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\Control Panel\Screen Saver.Marquee\Speed = "4"	smss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\Control Panel\Screen Saver.Marquee\Size = "72"	Gaara.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\Control Panel\Screen Saver.Marquee\Text = "Gaara The Kazekage ( Warning : don't save any porn stuffs files in this computer )"	Gaara.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\Control Panel\Screen Saver.Marquee\TextColor = "255 0 0"	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\Control Panel\Desktop	2025-05-02_afe201bb75b834f9b30f2f2bc170332e_black-basta_elex_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\Control Panel\Screen Saver.Marquee\Size = "72"	smss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\Control Panel\Desktop\ScreenSaveTimeOut = "400"	Gaara.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\Control Panel\Screen Saver.Marquee\Text = "Gaara The Kazekage ( Warning : don't save any porn stuffs files in this computer )"	Kazekage.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\Control Panel\Desktop\WallpaperStyle = "2"	smss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\Control Panel\Desktop\WallpaperStyle = "2"	csrss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\Control Panel\Desktop\SCRNSAVE.EXE = "ssmarque.scr"	Kazekage.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\Control Panel\Screen Saver.Marquee\BackgroundColor = "0 0 0"	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\Control Panel\Desktop	Kazekage.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\Control Panel\Screen Saver.Marquee\Mode.EXE = "1"	smss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\Control Panel\Screen Saver.Marquee\TextColor = "255 0 0"	Gaara.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\Control Panel\Desktop\SCRNSAVE.EXE = "ssmarque.scr"	2025-05-02_afe201bb75b834f9b30f2f2bc170332e_black-basta_elex_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\Control Panel\Screen Saver.Marquee\Size = "72"	2025-05-02_afe201bb75b834f9b30f2f2bc170332e_black-basta_elex_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\Control Panel\Screen Saver.Marquee\Text = "Gaara The Kazekage ( Warning : don't save any porn stuffs files in this computer )"	2025-05-02_afe201bb75b834f9b30f2f2bc170332e_black-basta_elex_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\Control Panel\Screen Saver.Marquee\Text = "Gaara The Kazekage ( Warning : don't save any porn stuffs files in this computer )"	system32.exe
Key created	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\Control Panel\Screen Saver.Marquee	Kazekage.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\Control Panel\Screen Saver.Marquee\Font = "Blackadder ITC"	Gaara.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\Control Panel\Screen Saver.Marquee\Speed = "4"	Gaara.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\Control Panel\Desktop\ConvertedWallpaper = "Fonts\\The Kazekage.jpg"	2025-05-02_afe201bb75b834f9b30f2f2bc170332e_black-basta_elex_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\Control Panel\Screen Saver.Marquee\TextColor = "255 0 0"	system32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\Control Panel\Desktop\ConvertedWallpaper = "Fonts\\The Kazekage.jpg"	Kazekage.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\Control Panel\Screen Saver.Marquee\TextColor = "255 0 0"	Kazekage.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\Control Panel\Desktop\ConvertedWallpaper = "Fonts\\The Kazekage.jpg"	csrss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\Control Panel\Screen Saver.Marquee\Text = "Gaara The Kazekage ( Warning : don't save any porn stuffs files in this computer )"	smss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\Control Panel\Desktop\SCRNSAVE.EXE = "ssmarque.scr"	Gaara.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\Control Panel\Screen Saver.Marquee\Font = "Blackadder ITC"	Kazekage.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\Control Panel\Screen Saver.Marquee\Mode.EXE = "1"	csrss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\Control Panel\Screen Saver.Marquee\Speed = "4"	csrss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\Control Panel\Screen Saver.Marquee\BackgroundColor = "0 0 0"	Gaara.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\Control Panel\Screen Saver.Marquee\TextColor = "255 0 0"	2025-05-02_afe201bb75b834f9b30f2f2bc170332e_black-basta_elex_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\Control Panel\Screen Saver.Marquee\Font = "Blackadder ITC"	csrss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\Control Panel\Screen Saver.Marquee\Text = "Gaara The Kazekage ( Warning : don't save any porn stuffs files in this computer )"	csrss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\Control Panel\Screen Saver.Marquee\BackgroundColor = "0 0 0"	system32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\Control Panel\Desktop\SCRNSAVE.EXE = "ssmarque.scr"	csrss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\Control Panel\Desktop\ConvertedWallpaper = "Fonts\\The Kazekage.jpg"	smss.exe
Key created	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\Control Panel\Screen Saver.Marquee	Gaara.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\Control Panel\Desktop\ScreenSaveTimeOut = "400"	2025-05-02_afe201bb75b834f9b30f2f2bc170332e_black-basta_elex_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\Control Panel\Screen Saver.Marquee\Font = "Blackadder ITC"	2025-05-02_afe201bb75b834f9b30f2f2bc170332e_black-basta_elex_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\Control Panel\Desktop\ConvertedWallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg"	csrss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\Control Panel\Desktop\ScreenSaveTimeOut = "400"	smss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\Control Panel\Screen Saver.Marquee\TextColor = "255 0 0"	smss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\Control Panel\Desktop\ScreenSaveTimeOut = "400"	Kazekage.exe

Modifies Internet Explorer settings 1 TTPs 12 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!"	smss.exe
Key created	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\Software\Microsoft\Internet Explorer\Main	Gaara.exe
Key created	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\Software\Microsoft\Internet Explorer\Main	2025-05-02_afe201bb75b834f9b30f2f2bc170332e_black-basta_elex_hijackloader_luca-stealer.exe
Key created	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\Software\Microsoft\Internet Explorer\Main	system32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!"	system32.exe
Key created	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\Software\Microsoft\Internet Explorer\Main	csrss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!"	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\Software\Microsoft\Internet Explorer\Main	smss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!"	Gaara.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!"	2025-05-02_afe201bb75b834f9b30f2f2bc170332e_black-basta_elex_hijackloader_luca-stealer.exe
Key created	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\Software\Microsoft\Internet Explorer\Main	Kazekage.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!"	Kazekage.exe

Modifies registry class 51 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe"	Gaara.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe"	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0"	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command	2025-05-02_afe201bb75b834f9b30f2f2bc170332e_black-basta_elex_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe"	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command	Gaara.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe"	Gaara.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command	2025-05-02_afe201bb75b834f9b30f2f2bc170332e_black-basta_elex_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0"	2025-05-02_afe201bb75b834f9b30f2f2bc170332e_black-basta_elex_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0"	system32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command	Kazekage.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe"	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command	Gaara.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe"	Kazekage.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe"	2025-05-02_afe201bb75b834f9b30f2f2bc170332e_black-basta_elex_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe"	2025-05-02_afe201bb75b834f9b30f2f2bc170332e_black-basta_elex_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe"	system32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command	system32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe"	system32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe"	Kazekage.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command	Kazekage.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command	Kazekage.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe"	Gaara.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command	Gaara.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0"	Gaara.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command	2025-05-02_afe201bb75b834f9b30f2f2bc170332e_black-basta_elex_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe"	2025-05-02_afe201bb75b834f9b30f2f2bc170332e_black-basta_elex_hijackloader_luca-stealer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command	2025-05-02_afe201bb75b834f9b30f2f2bc170332e_black-basta_elex_hijackloader_luca-stealer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command	system32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command	Kazekage.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe"	Kazekage.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe"	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command	Gaara.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command	system32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe"	system32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command	system32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0"	Kazekage.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command	csrss.exe

Runs ping.exe 1 TTPs 34 IoCs

Remote System Discovery

T1018

pid	Process
4840	ping.exe
4344	ping.exe
5172	ping.exe
5980	ping.exe
4656	ping.exe
2112	ping.exe
5464	ping.exe
5380	ping.exe
1376	ping.exe
2576	ping.exe
3984	ping.exe
5372	ping.exe
2992	ping.exe
1728	ping.exe
2960	ping.exe
5072	ping.exe
4380	ping.exe
1844	ping.exe
1796	ping.exe
5628	ping.exe
2976	ping.exe
4856	ping.exe
4528	ping.exe
5212	ping.exe
3196	ping.exe
1552	ping.exe
4104	ping.exe
5584	ping.exe
1632	ping.exe
980	ping.exe
4848	ping.exe
5364	ping.exe
5964	ping.exe
5844	ping.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1484	smss.exe
1484	smss.exe
1484	smss.exe
1484	smss.exe
1484	smss.exe
1484	smss.exe
1484	smss.exe
1484	smss.exe
1484	smss.exe
1484	smss.exe
1484	smss.exe
1484	smss.exe
1484	smss.exe
1484	smss.exe
1484	smss.exe
1484	smss.exe
1484	smss.exe
1484	smss.exe
1484	smss.exe
1484	smss.exe
1484	smss.exe
1484	smss.exe
1484	smss.exe
1484	smss.exe
6012	Gaara.exe
6012	Gaara.exe
6012	Gaara.exe
6012	Gaara.exe
6012	Gaara.exe
6012	Gaara.exe
6012	Gaara.exe
6012	Gaara.exe
6012	Gaara.exe
6012	Gaara.exe
6012	Gaara.exe
6012	Gaara.exe
6012	Gaara.exe
6012	Gaara.exe
6012	Gaara.exe
6012	Gaara.exe
6012	Gaara.exe
6012	Gaara.exe
6012	Gaara.exe
6012	Gaara.exe
6012	Gaara.exe
6012	Gaara.exe
6012	Gaara.exe
6012	Gaara.exe
2064	2025-05-02_afe201bb75b834f9b30f2f2bc170332e_black-basta_elex_hijackloader_luca-stealer.exe
2064	2025-05-02_afe201bb75b834f9b30f2f2bc170332e_black-basta_elex_hijackloader_luca-stealer.exe
2064	2025-05-02_afe201bb75b834f9b30f2f2bc170332e_black-basta_elex_hijackloader_luca-stealer.exe
2064	2025-05-02_afe201bb75b834f9b30f2f2bc170332e_black-basta_elex_hijackloader_luca-stealer.exe
2064	2025-05-02_afe201bb75b834f9b30f2f2bc170332e_black-basta_elex_hijackloader_luca-stealer.exe
2064	2025-05-02_afe201bb75b834f9b30f2f2bc170332e_black-basta_elex_hijackloader_luca-stealer.exe
2064	2025-05-02_afe201bb75b834f9b30f2f2bc170332e_black-basta_elex_hijackloader_luca-stealer.exe
2064	2025-05-02_afe201bb75b834f9b30f2f2bc170332e_black-basta_elex_hijackloader_luca-stealer.exe
2064	2025-05-02_afe201bb75b834f9b30f2f2bc170332e_black-basta_elex_hijackloader_luca-stealer.exe
2064	2025-05-02_afe201bb75b834f9b30f2f2bc170332e_black-basta_elex_hijackloader_luca-stealer.exe
2064	2025-05-02_afe201bb75b834f9b30f2f2bc170332e_black-basta_elex_hijackloader_luca-stealer.exe
2064	2025-05-02_afe201bb75b834f9b30f2f2bc170332e_black-basta_elex_hijackloader_luca-stealer.exe
2064	2025-05-02_afe201bb75b834f9b30f2f2bc170332e_black-basta_elex_hijackloader_luca-stealer.exe
2064	2025-05-02_afe201bb75b834f9b30f2f2bc170332e_black-basta_elex_hijackloader_luca-stealer.exe
2064	2025-05-02_afe201bb75b834f9b30f2f2bc170332e_black-basta_elex_hijackloader_luca-stealer.exe
2064	2025-05-02_afe201bb75b834f9b30f2f2bc170332e_black-basta_elex_hijackloader_luca-stealer.exe

Suspicious use of SetWindowsHookEx 31 IoCs

pid	Process
2064	2025-05-02_afe201bb75b834f9b30f2f2bc170332e_black-basta_elex_hijackloader_luca-stealer.exe
1484	smss.exe
4344	smss.exe
6012	Gaara.exe
4684	smss.exe
4568	Gaara.exe
5140	csrss.exe
448	smss.exe
1472	Gaara.exe
4968	Gaara.exe
1908	csrss.exe
3552	csrss.exe
920	csrss.exe
2892	Kazekage.exe
2576	Kazekage.exe
1308	Kazekage.exe
2632	system32.exe
5940	smss.exe
2260	system32.exe
1088	Kazekage.exe
4228	smss.exe
3752	system32.exe
3948	Gaara.exe
3312	Gaara.exe
3540	csrss.exe
2296	csrss.exe
624	Kazekage.exe
5560	Kazekage.exe
2180	system32.exe
2300	system32.exe
4064	system32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2064 wrote to memory of 1484	2064	2025-05-02_afe201bb75b834f9b30f2f2bc170332e_black-basta_elex_hijackloader_luca-stealer.exe	87
PID 2064 wrote to memory of 1484	2064	2025-05-02_afe201bb75b834f9b30f2f2bc170332e_black-basta_elex_hijackloader_luca-stealer.exe	87
PID 2064 wrote to memory of 1484	2064	2025-05-02_afe201bb75b834f9b30f2f2bc170332e_black-basta_elex_hijackloader_luca-stealer.exe	87
PID 1484 wrote to memory of 4344	1484	smss.exe	88
PID 1484 wrote to memory of 4344	1484	smss.exe	88
PID 1484 wrote to memory of 4344	1484	smss.exe	88
PID 1484 wrote to memory of 6012	1484	smss.exe	89
PID 1484 wrote to memory of 6012	1484	smss.exe	89
PID 1484 wrote to memory of 6012	1484	smss.exe	89
PID 6012 wrote to memory of 4684	6012	Gaara.exe	91
PID 6012 wrote to memory of 4684	6012	Gaara.exe	91
PID 6012 wrote to memory of 4684	6012	Gaara.exe	91
PID 6012 wrote to memory of 4568	6012	Gaara.exe	93
PID 6012 wrote to memory of 4568	6012	Gaara.exe	93
PID 6012 wrote to memory of 4568	6012	Gaara.exe	93
PID 6012 wrote to memory of 5140	6012	Gaara.exe	94
PID 6012 wrote to memory of 5140	6012	Gaara.exe	94
PID 6012 wrote to memory of 5140	6012	Gaara.exe	94
PID 5140 wrote to memory of 448	5140	csrss.exe	97
PID 5140 wrote to memory of 448	5140	csrss.exe	97
PID 5140 wrote to memory of 448	5140	csrss.exe	97
PID 2064 wrote to memory of 1472	2064	2025-05-02_afe201bb75b834f9b30f2f2bc170332e_black-basta_elex_hijackloader_luca-stealer.exe	98
PID 2064 wrote to memory of 1472	2064	2025-05-02_afe201bb75b834f9b30f2f2bc170332e_black-basta_elex_hijackloader_luca-stealer.exe	98
PID 2064 wrote to memory of 1472	2064	2025-05-02_afe201bb75b834f9b30f2f2bc170332e_black-basta_elex_hijackloader_luca-stealer.exe	98
PID 5140 wrote to memory of 4968	5140	csrss.exe	100
PID 5140 wrote to memory of 4968	5140	csrss.exe	100
PID 5140 wrote to memory of 4968	5140	csrss.exe	100
PID 5140 wrote to memory of 3552	5140	csrss.exe	101
PID 5140 wrote to memory of 3552	5140	csrss.exe	101
PID 5140 wrote to memory of 3552	5140	csrss.exe	101
PID 2064 wrote to memory of 1908	2064	2025-05-02_afe201bb75b834f9b30f2f2bc170332e_black-basta_elex_hijackloader_luca-stealer.exe	102
PID 2064 wrote to memory of 1908	2064	2025-05-02_afe201bb75b834f9b30f2f2bc170332e_black-basta_elex_hijackloader_luca-stealer.exe	102
PID 2064 wrote to memory of 1908	2064	2025-05-02_afe201bb75b834f9b30f2f2bc170332e_black-basta_elex_hijackloader_luca-stealer.exe	102
PID 1484 wrote to memory of 920	1484	smss.exe	103
PID 1484 wrote to memory of 920	1484	smss.exe	103
PID 1484 wrote to memory of 920	1484	smss.exe	103
PID 2064 wrote to memory of 2892	2064	2025-05-02_afe201bb75b834f9b30f2f2bc170332e_black-basta_elex_hijackloader_luca-stealer.exe	106
PID 2064 wrote to memory of 2892	2064	2025-05-02_afe201bb75b834f9b30f2f2bc170332e_black-basta_elex_hijackloader_luca-stealer.exe	106
PID 2064 wrote to memory of 2892	2064	2025-05-02_afe201bb75b834f9b30f2f2bc170332e_black-basta_elex_hijackloader_luca-stealer.exe	106
PID 5140 wrote to memory of 2576	5140	csrss.exe	107
PID 5140 wrote to memory of 2576	5140	csrss.exe	107
PID 5140 wrote to memory of 2576	5140	csrss.exe	107
PID 1484 wrote to memory of 1308	1484	smss.exe	108
PID 1484 wrote to memory of 1308	1484	smss.exe	108
PID 1484 wrote to memory of 1308	1484	smss.exe	108
PID 2892 wrote to memory of 5940	2892	Kazekage.exe	111
PID 2892 wrote to memory of 5940	2892	Kazekage.exe	111
PID 2892 wrote to memory of 5940	2892	Kazekage.exe	111
PID 1484 wrote to memory of 2260	1484	smss.exe	109
PID 1484 wrote to memory of 2260	1484	smss.exe	109
PID 1484 wrote to memory of 2260	1484	smss.exe	109
PID 5140 wrote to memory of 2632	5140	csrss.exe	110
PID 5140 wrote to memory of 2632	5140	csrss.exe	110
PID 5140 wrote to memory of 2632	5140	csrss.exe	110
PID 6012 wrote to memory of 1088	6012	Gaara.exe	112
PID 6012 wrote to memory of 1088	6012	Gaara.exe	112
PID 6012 wrote to memory of 1088	6012	Gaara.exe	112
PID 2632 wrote to memory of 4228	2632	system32.exe	113
PID 2632 wrote to memory of 4228	2632	system32.exe	113
PID 2632 wrote to memory of 4228	2632	system32.exe	113
PID 2892 wrote to memory of 3948	2892	Kazekage.exe	114
PID 2892 wrote to memory of 3948	2892	Kazekage.exe	114
PID 2892 wrote to memory of 3948	2892	Kazekage.exe	114
PID 6012 wrote to memory of 3752	6012	Gaara.exe	115

System policy modification 1 TTPs 12 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	system32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	system32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	Kazekage.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Kazekage.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	Gaara.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	2025-05-02_afe201bb75b834f9b30f2f2bc170332e_black-basta_elex_hijackloader_luca-stealer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2025-05-02_afe201bb75b834f9b30f2f2bc170332e_black-basta_elex_hijackloader_luca-stealer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	smss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Gaara.exe

C:\Users\Admin\AppData\Local\Temp\2025-05-02_afe201bb75b834f9b30f2f2bc170332e_black-basta_elex_hijackloader_luca-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2025-05-02_afe201bb75b834f9b30f2f2bc170332e_black-basta_elex_hijackloader_luca-stealer.exe"
1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2064
- C:\Windows\Fonts\Admin 2 - 5 - 2025\smss.exe
  "C:\Windows\Fonts\Admin 2 - 5 - 2025\smss.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - UAC bypass
  - Disables RegEdit via registry modification
  - Drops file in Drivers directory
  - Event Triggered Execution: Image File Execution Options Injection
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Drops desktop.ini file(s)
  - Enumerates connected drives
  - Drops autorun.inf file
  - Drops file in System32 directory
  - Sets desktop wallpaper using registry
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Modifies Control Panel
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:1484
- - C:\Windows\Fonts\Admin 2 - 5 - 2025\smss.exe
    "C:\Windows\Fonts\Admin 2 - 5 - 2025\smss.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4344
- - C:\Windows\Fonts\Admin 2 - 5 - 2025\Gaara.exe
    "C:\Windows\Fonts\Admin 2 - 5 - 2025\Gaara.exe"
    3⤵
    - Modifies WinLogon for persistence
    - Modifies visibility of file extensions in Explorer
    - Modifies visiblity of hidden/system files in Explorer
    - UAC bypass
    - Disables RegEdit via registry modification
    - Drops file in Drivers directory
    - Event Triggered Execution: Image File Execution Options Injection
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Drops desktop.ini file(s)
    - Enumerates connected drives
    - Drops autorun.inf file
    - Drops file in System32 directory
    - Sets desktop wallpaper using registry
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Modifies Control Panel
    - Modifies Internet Explorer settings
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:6012
  - - C:\Windows\Fonts\Admin 2 - 5 - 2025\smss.exe
      "C:\Windows\Fonts\Admin 2 - 5 - 2025\smss.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:4684
  - - C:\Windows\Fonts\Admin 2 - 5 - 2025\Gaara.exe
      "C:\Windows\Fonts\Admin 2 - 5 - 2025\Gaara.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:4568
  - - C:\Windows\Fonts\Admin 2 - 5 - 2025\csrss.exe
      "C:\Windows\Fonts\Admin 2 - 5 - 2025\csrss.exe"
      4⤵
      Modifies WinLogon for persistence
      Modifies visibility of file extensions in Explorer
      Modifies visiblity of hidden/system files in Explorer
      UAC bypass
      Disables RegEdit via registry modification
      Drops file in Drivers directory
      Event Triggered Execution: Image File Execution Options Injection
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Checks whether UAC is enabled
      Drops desktop.ini file(s)
      Enumerates connected drives
      Drops autorun.inf file
      Drops file in System32 directory
      Sets desktop wallpaper using registry
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Modifies Control Panel
      Modifies Internet Explorer settings
      Modifies registry class
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:5140
    - - C:\Windows\Fonts\Admin 2 - 5 - 2025\smss.exe
        
        "C:\Windows\Fonts\Admin 2 - 5 - 2025\smss.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:448
    - - C:\Windows\Fonts\Admin 2 - 5 - 2025\Gaara.exe
        
        "C:\Windows\Fonts\Admin 2 - 5 - 2025\Gaara.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4968
    - - C:\Windows\Fonts\Admin 2 - 5 - 2025\csrss.exe
        
        "C:\Windows\Fonts\Admin 2 - 5 - 2025\csrss.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3552
    - - C:\Windows\SysWOW64\drivers\Kazekage.exe
        
        C:\Windows\system32\drivers\Kazekage.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2576
    - - C:\Windows\SysWOW64\drivers\system32.exe
        
        C:\Windows\system32\drivers\system32.exe
        5⤵
        Modifies WinLogon for persistence
        Modifies visibility of file extensions in Explorer
        Modifies visiblity of hidden/system files in Explorer
        UAC bypass
        Disables RegEdit via registry modification
        Drops file in Drivers directory
        Event Triggered Execution: Image File Execution Options Injection
        Executes dropped EXE
        Adds Run key to start application
        Checks whether UAC is enabled
        Drops desktop.ini file(s)
        Enumerates connected drives
        Drops autorun.inf file
        Drops file in System32 directory
        Sets desktop wallpaper using registry
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Modifies Control Panel
        Modifies Internet Explorer settings
        Modifies registry class
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:2632
      - C:\Windows\Fonts\Admin 2 - 5 - 2025\smss.exe
        
        "C:\Windows\Fonts\Admin 2 - 5 - 2025\smss.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4228
      - C:\Windows\Fonts\Admin 2 - 5 - 2025\Gaara.exe
        
        "C:\Windows\Fonts\Admin 2 - 5 - 2025\Gaara.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3312
      - C:\Windows\Fonts\Admin 2 - 5 - 2025\csrss.exe
        
        "C:\Windows\Fonts\Admin 2 - 5 - 2025\csrss.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2296
      - C:\Windows\SysWOW64\drivers\Kazekage.exe
        
        C:\Windows\system32\drivers\Kazekage.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:5560
      - C:\Windows\SysWOW64\drivers\system32.exe
        
        C:\Windows\system32\drivers\system32.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2300
      - C:\Windows\SysWOW64\ping.exe
        
        ping -a -l www.rasasayang.com.my 65500
        6⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4104
      - C:\Windows\SysWOW64\ping.exe
        
        ping -a -l www.duniasex.com 65500
        6⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5980
      - C:\Windows\SysWOW64\ping.exe
        
        ping -a -l www.rasasayang.com.my 65500
        6⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5628
      - C:\Windows\SysWOW64\ping.exe
        
        ping -a -l www.duniasex.com 65500
        6⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1796
      - C:\Windows\SysWOW64\ping.exe
        
        ping -a -l www.rasasayang.com.my 65500
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2112
      - C:\Windows\SysWOW64\ping.exe
        
        ping -a -l www.duniasex.com 65500
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3196
    - - C:\Windows\SysWOW64\ping.exe
        
        ping -a -l www.rasasayang.com.my 65500
        5⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4380
    - - C:\Windows\SysWOW64\ping.exe
        
        ping -a -l www.duniasex.com 65500
        5⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5364
    - - C:\Windows\SysWOW64\ping.exe
        
        ping -a -l www.rasasayang.com.my 65500
        5⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5964
    - - C:\Windows\SysWOW64\ping.exe
        
        ping -a -l www.duniasex.com 65500
        5⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:980
    - - C:\Windows\SysWOW64\ping.exe
        
        ping -a -l www.rasasayang.com.my 65500
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2976
    - - C:\Windows\SysWOW64\ping.exe
        
        ping -a -l www.duniasex.com 65500
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4344
  - - C:\Windows\SysWOW64\drivers\Kazekage.exe
      C:\Windows\system32\drivers\Kazekage.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1088
  - - C:\Windows\SysWOW64\drivers\system32.exe
      C:\Windows\system32\drivers\system32.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:3752
  - - C:\Windows\SysWOW64\ping.exe
      ping -a -l www.rasasayang.com.my 65500
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:1376
  - - C:\Windows\SysWOW64\ping.exe
      ping -a -l www.duniasex.com 65500
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:5380
  - - C:\Windows\SysWOW64\ping.exe
      ping -a -l www.rasasayang.com.my 65500
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:1728
  - - C:\Windows\SysWOW64\ping.exe
      ping -a -l www.duniasex.com 65500
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:3984
  - - C:\Windows\SysWOW64\ping.exe
      ping -a -l www.rasasayang.com.my 65500
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:1552
  - - C:\Windows\SysWOW64\ping.exe
      ping -a -l www.duniasex.com 65500
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:5212
- - C:\Windows\Fonts\Admin 2 - 5 - 2025\csrss.exe
    "C:\Windows\Fonts\Admin 2 - 5 - 2025\csrss.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:920
- - C:\Windows\SysWOW64\drivers\Kazekage.exe
    C:\Windows\system32\drivers\Kazekage.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1308
- - C:\Windows\SysWOW64\drivers\system32.exe
    C:\Windows\system32\drivers\system32.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2260
- - C:\Windows\SysWOW64\ping.exe
    ping -a -l www.rasasayang.com.my 65500
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4840
- - C:\Windows\SysWOW64\ping.exe
    ping -a -l www.duniasex.com 65500
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:1632
- - C:\Windows\SysWOW64\ping.exe
    ping -a -l www.rasasayang.com.my 65500
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:5844
- - C:\Windows\SysWOW64\ping.exe
    ping -a -l www.duniasex.com 65500
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4528
- C:\Windows\Fonts\Admin 2 - 5 - 2025\Gaara.exe
  "C:\Windows\Fonts\Admin 2 - 5 - 2025\Gaara.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1472
- C:\Windows\Fonts\Admin 2 - 5 - 2025\csrss.exe
  "C:\Windows\Fonts\Admin 2 - 5 - 2025\csrss.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1908
- C:\Windows\SysWOW64\drivers\Kazekage.exe
  C:\Windows\system32\drivers\Kazekage.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - UAC bypass
  - Disables RegEdit via registry modification
  - Drops file in Drivers directory
  - Event Triggered Execution: Image File Execution Options Injection
  - Executes dropped EXE
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Drops desktop.ini file(s)
  - Enumerates connected drives
  - Drops autorun.inf file
  - Drops file in System32 directory
  - Sets desktop wallpaper using registry
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Modifies Control Panel
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:2892
- - C:\Windows\Fonts\Admin 2 - 5 - 2025\smss.exe
    "C:\Windows\Fonts\Admin 2 - 5 - 2025\smss.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:5940
- - C:\Windows\Fonts\Admin 2 - 5 - 2025\Gaara.exe
    "C:\Windows\Fonts\Admin 2 - 5 - 2025\Gaara.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:3948
- - C:\Windows\Fonts\Admin 2 - 5 - 2025\csrss.exe
    "C:\Windows\Fonts\Admin 2 - 5 - 2025\csrss.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:3540
- - C:\Windows\SysWOW64\drivers\Kazekage.exe
    C:\Windows\system32\drivers\Kazekage.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:624
- - C:\Windows\SysWOW64\drivers\system32.exe
    C:\Windows\system32\drivers\system32.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2180
- - C:\Windows\SysWOW64\ping.exe
    ping -a -l www.rasasayang.com.my 65500
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2576
- - C:\Windows\SysWOW64\ping.exe
    ping -a -l www.duniasex.com 65500
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2992
- - C:\Windows\SysWOW64\ping.exe
    ping -a -l www.rasasayang.com.my 65500
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4848
- - C:\Windows\SysWOW64\ping.exe
    ping -a -l www.duniasex.com 65500
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:1844
- - C:\Windows\SysWOW64\ping.exe
    ping -a -l www.rasasayang.com.my 65500
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4856
- - C:\Windows\SysWOW64\ping.exe
    ping -a -l www.duniasex.com 65500
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:5172
- C:\Windows\SysWOW64\drivers\system32.exe
  C:\Windows\system32\drivers\system32.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4064
- C:\Windows\SysWOW64\ping.exe
  ping -a -l www.rasasayang.com.my 65500
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:5584
- C:\Windows\SysWOW64\ping.exe
  ping -a -l www.duniasex.com 65500
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:5464
- C:\Windows\SysWOW64\ping.exe
  ping -a -l www.rasasayang.com.my 65500
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:4656
- C:\Windows\SysWOW64\ping.exe
  ping -a -l www.duniasex.com 65500
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:5072
- C:\Windows\SysWOW64\ping.exe
  ping -a -l www.rasasayang.com.my 65500
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:5372
- C:\Windows\SysWOW64\ping.exe
  ping -a -l www.duniasex.com 65500
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:2960

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:4348

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:2368

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:5244

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:5820

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:2164

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:4536

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:2748

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:1316

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:6064

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:5584

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:5464

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:4336

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:3172

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:3576

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:3908

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:6136

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:932

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:4344

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:2776

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:2280

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:1840

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:4572

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:4820

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:5024

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:5880

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:1744

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:4796

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:5876

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:3164

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:4152

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:1048

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:2992

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:3720

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:1308

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:1724

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:3668

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:372

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:1752

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:6068

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:2292

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:3724

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:3464

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:4184

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:5104

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:3796

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:532

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:5320

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:5872

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:5560

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:6024

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:1988

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:5260

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:2808

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:4108

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:3048

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:5632

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:5604

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:5048

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:5884

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:1716

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:348

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:3844

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:3936

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:692

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:4696

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:932

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:2176

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:2776

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:4828

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:4572

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:5540

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:1592

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:5876

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:1468

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:4576

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:2028

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:3320

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:1572

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:412

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:3200

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:1384

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:6036

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:3176

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:5072

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:2664

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:2292

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:6000

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:2540

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:5676

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:2184

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:2268

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:2044

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:3216

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:1940

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:2660

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:5872

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:2208

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:2164

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:1680

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:3100

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:2472

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:2172

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:4620

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:5108

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:2852

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:4788

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:5060

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:740

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:4900

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:1716

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:4380

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:5376

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:4416

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:3968

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:4192

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:5092

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:6004

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:2664

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:5612

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:6000

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:5852

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:1316

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:456

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:4624

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:2604

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:4732

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:1748

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:3868

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:4208

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:3292

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:4660

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:5260

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:2076

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:3844

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:1624

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:4644

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:4476

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:4712

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:3652

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:1884

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:5196

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:3328

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:1592

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:448

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:4568

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:3164

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:2024

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:5276

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:3180

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:5504

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:2236

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:4340

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:1976

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:5676

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:6004

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:708

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:4368

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:3488

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:5820

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:3052

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:412
- C:\Windows\System32\Conhost.exe
  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
  2⤵
  PID:5464

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:1160

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:692

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:4532

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:5056

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:3524

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:4316

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:2400

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:3300

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:5884

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:5628

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:3304

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:4212

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:4344

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:5048
- C:\Windows\System32\Conhost.exe
  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
  2⤵
  PID:5584

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:216

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:348

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:5540

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:5012

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:2176

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:4908

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:1460

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:964

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:1212

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:4204

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:4596

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:5392

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:2828

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:3768

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:2644

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:3312

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:2996

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:1932

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:1652

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:3288

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:4844

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:2680

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:3748

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:3488

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:3148

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:1728

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:1684

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:5464

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:4040

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:3528

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:1248

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:5176

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:2056

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:628

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:5584

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:4600

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:3656

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:4652

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:1744

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:4488

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:2176

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:1840

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:3028

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:5700

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:5196

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:1204

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:5808

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:944

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:6112

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:2292

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:5508

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:1640

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:2224

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:1200

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:5940

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:4000

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:4624

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:1060

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:5200

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:1944

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:2748

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:1940

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:5080

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:2528

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:5932

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:3100

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:3728

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:3604

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:5172

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:692

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:5420

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:684

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:1820

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:3300

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:5176

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:3848

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:4068

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:4956

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:840

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:4708

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:4544

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:3172

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:4740

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:4816

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:4640

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:964

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:3704

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:1472

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:4488

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:452

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:2304

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:4756

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:740

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:5588

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:1492

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:3724

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:2168

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:5592

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:1844

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:2948

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:3352

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:4328

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:5612

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:4380

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:3948

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:6016

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:5852

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:3404

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:1612

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:2272

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:5888

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:2044

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:4784

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:4304

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:1748

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:4760

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:4588

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:1572

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:6136

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:4512

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:6084

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:4024

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:5284

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:2172

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:5520

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:6104

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:4604

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:4956

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:6048

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:4740

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:4640

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:4684

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:3004

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:3232

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:3676

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:5564

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:3028

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:4540

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:5496

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:4596

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:2144

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:5528

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:2772

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:4092

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:5392

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:5828

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:5452

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:5592

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:4088

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:5132

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:5712

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:5780

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:2468
- C:\Windows\System32\Conhost.exe
  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
  2⤵
  PID:5980

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:4768

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:2112

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:1712

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:5024

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:3336

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:3280

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:2288

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:3048

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:2324

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:3220

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:3172

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:4676

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:4684

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:5020

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:5340

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:2852

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:1840

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:4392

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:3232

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:5548

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:6036

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:5052

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:3024

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:5372

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:2224

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:5352

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:2772

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:5508

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:4144

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:2948

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:2924

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:976

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:4528

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:4312

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:4500

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:532

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:5800

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:3624

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:1496

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:3608

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:4976

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:4440

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:680

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:5852

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:3848

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:4420

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:2696

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:4588

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:2288

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:6088

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:2300

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:4400

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:3220

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:1064

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:840

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:4476

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:3604

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:2400

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:3420

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:4952

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:3124

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:4228

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:1304

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:3792

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:2828

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:4284

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:4756

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:5052

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:4372

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:4052

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:5808

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:1824

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:976

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:8

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:1136

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:5388

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:1988

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:5452

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:4492

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:5080

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:5872

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:5796

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:1496

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:5560

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:2468

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:3620

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:1648

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:2664

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:1376

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:5176

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:4956

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:844

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:4544

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:4400

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:5584

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:6084

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:3428

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:1744

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:4432

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:1748

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:4360

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:4600
- C:\Windows\System32\Conhost.exe
  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
  2⤵
  PID:3984

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:4864

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:4684

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:5496

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:4744

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:740

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:4192

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:1048

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:5716

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:5672

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:1640

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:4152

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:4832

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:2588

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:2660

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:4500

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:708

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:4552

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:2948

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:2544

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:5080

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:1988

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:1348

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:5188

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:5944

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:3224

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:412

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:348

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:4840

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:6096

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:4304
- C:\Windows\System32\Conhost.exe
  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
  2⤵
  PID:1728

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:6024

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:2664

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:3548

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:5464

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:3300

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:1272

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:5284

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:6064

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:5076

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:1212

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:2776

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:2172

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:5340

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:1744

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:3564

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:4796

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:3420

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:2556

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:3028

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:3768

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:4900

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:6044

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:636

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:5548

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:5516

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:4596

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:6112

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:3164

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:5480

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:3168

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:1888

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:5352

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:2368

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:976

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:5876

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:2924

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:2044

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:6016

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:5292

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:1944

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:3912

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:3756

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:2544

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:5560

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:3188

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:5944

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:4256

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:1276

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:4440

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:2336

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:3748

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:3484

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:4620

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:4708

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:2696

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:4956

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:5880

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:5472

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:5176

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:5584

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:4960

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:4748

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:1120

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:4664

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:4204

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:2612

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:1744

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:5920

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:2364

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:1304

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:1732

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:4188

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:4540

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:5092

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:3676

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:2268

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:5568

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:2052

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:3260

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:4820

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:5456

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:1524

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:1932

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:2588

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:5532

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:5676

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:2044

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:3216

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:776

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:4468

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:2808

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:1636

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:4708

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:980

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:4404

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:5284

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:3220

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:5020

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:2252

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:4748

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:3700

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:1748

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:5920

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:1752

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:2828

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:4248

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:5832

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:2580

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:5548

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:4744

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:5104

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:2376

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:1204

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:4328

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:6112

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:5568

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:2924

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:3192

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:1932

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:4856

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:1976

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:5844

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:1052

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:1264

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:5864

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:2044

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:3488

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:4480

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:3224
- C:\Windows\System32\Conhost.exe
  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
  2⤵
  PID:1796

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:776

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:2748

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:4692

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:3116

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:4716

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:1272

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:836

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:3280

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:4964

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:216

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:3924

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:3704

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:1472

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:4576

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:4204

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:3276

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:5084

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:920

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:3768

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:944

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:5808

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:2168

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:5968

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:2580

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:4392

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:2944

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:2144

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:1844

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:2180

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:4364

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:4656

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:2368

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:4192

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:5180

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:4552

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:4252

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:3216

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:1816

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:1200

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:3184

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:3756

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:1376

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:4840

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:4232

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:744

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:3528

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:5616

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:1172

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:1468

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:4680

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:3044

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:4640

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:4404

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:1768

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:4452

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:1592

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:3180

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:1472

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:5020

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:1748

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:208

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:840

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:4756

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:2388

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:2996

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:2232

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:6128

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:1844

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:2744

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:2524

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:740

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:5664

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:1944

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:4848

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:6000

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:1940

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:5592

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:4492

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:4876

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:5976

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:1976

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:2384

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:3944

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:4764

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:4104

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:4068

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:628

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:1636

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:4760

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:5628

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:1244

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:5176

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:5652

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:5336

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:3736

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:5356

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:6020

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:2756

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:1468

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:1784

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:4404

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:3652

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:216

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:2364

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:5564

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:5956

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:232

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

Readme.txt

Path C:\Admin Games\Readme.txt
Size 736B
SHA256 5db2e0915b5464d32e83484f8ae5e3c73d2c78f238fde5f58f9b40dbb5322de8
MD5 bb5d6abdf8d0948ac6895ce7fdfbc151
SHA1 9266b7a247a4685892197194d2b9b86c8f6dddbd
SHA512 878444760e8df878d65bb62b4798177e168eb099def58ad3634f4348e96705c83f74324f9fa358f0eff389991976698a233ca53e9b72034ae11c86d42322a76c
MD5 SHA1 SHA512

Submit Download

Autorun.inf

Path C:\Autorun.inf
Size 196B
SHA256 be114a2dbcc08540b314b01882aa836a772a883322a77b67aab31233e26dc184
MD5 1564dfe69ffed40950e5cb644e0894d1
SHA1 201b6f7a01cc49bb698bea6d4945a082ed454ce4
SHA512 72df187e39674b657974392cfa268e71ef86dc101ebd2303896381ca56d3c05aa9db3f0ab7d0e428d7436e0108c8f19e94c2013814d30b0b95a23a6b9e341097
MD5 SHA1 SHA512

Submit Download

Gaara.exe

Path C:\Windows\Fonts\Admin 2 - 5 - 2025\Gaara.exe
Size 9.4MB
SHA256 9725299ec8926fdf52379932c2472801ea33e9b3861d372d600ff02967b2a9f2
MD5 94255248f40bd077f9a93a6d786965bb
SHA1 a52b82a580d224e2d7a08ce53023cfa4347aafb4
SHA512 5cc291921b0b1da48d827b453068e4ebf269b91f736e04ce6f24bcc92a47aab90d310ae3f7e42d6a01c65446be45f3a6ad5dfa7710ecb08672c2644f29e2eb6b
SSDEEP 98304:iGyqWyWy0GyqWyWyMRPC1eHL5dGYSEYvZ:X1eHL5dEvZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

csrss.exe

Path C:\Windows\Fonts\Admin 2 - 5 - 2025\csrss.exe
Size 9.4MB
SHA256 4e087433f3f78b95be3d2b9d356e7e1a01cf5ef8ba9a845c26b51f10f7792673
MD5 afe201bb75b834f9b30f2f2bc170332e
SHA1 2bd0d8db872b405944d669c5508fbf5fb42a6f51
SHA512 af8f6f8b5e4445b476edb881a79bb6de40978c5c03b6dbcf176c61c40568c356558fd4f1469df098651bb8a7e64fb05cc3db007a88bc323934c7da1d74549874
SSDEEP 98304:AGyqWyWy0GyqWyWyMRPC1eHL5dGYSEYvZ:t1eHL5dEvZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

csrss.exe

Path C:\Windows\Fonts\Admin 2 - 5 - 2025\csrss.exe
Size 9.4MB
SHA256 bbbe26abf9da52b7655c19d27a150843485cd85e4d2c80c4c086f05089799f4b
MD5 a7b223cbabd11839059721b4705c682e
SHA1 8bb8178fcdaabafb4d91fed39d1d92409dd0b383
SHA512 56844cfbd3f7f7876390f4eb0dd441a1b81d8a76308dbb65e61c201b63625718b34d85764930d971cd612d5eb00b6e76195080e2725cfdaefded9c5e155a9000
SSDEEP 98304:FGyqWyWy0GyqWyWyMRPC1eHL5dGYSEYvZ:G1eHL5dEvZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

smss.exe

Path C:\Windows\Fonts\Admin 2 - 5 - 2025\smss.exe
Size 9.4MB
SHA256 11bd9853a9027c9cbfb8fbe06aba894e7ddb6458453eaf5d6d629582c0d9b376
MD5 d9aa8a35b42b080ba12ef9731d6fbd2a
SHA1 dcf83f086296dd1cbd66511071bd2b3c486e0bad
SHA512 7bd8b240e7bbe59d9f9010c85c20b86830ac8e33a7b2b39af810a9bee8cd3a858f4b30bf98bcaaaf25e50a74a44cc55db8509252ed23fe1a9523540e0d7d6312
SSDEEP 98304:dGyqWyWy0GyqWyWyMRPC1eHL5dGYSEYvZ:O1eHL5dEvZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

The Kazekage.jpg

Path C:\Windows\Fonts\The Kazekage.jpg
Size 1.4MB
SHA256 9824b98dab6af65a9e84c2ea40e9df948f9766ce2096e81feecad7db8dd6080a
MD5 d6b05020d4a0ec2a3a8b687099e335df
SHA1 df239d830ebcd1cde5c68c46a7b76dad49d415f4
SHA512 78fd360faa4d34f5732056d6e9ad7b9930964441c69cf24535845d397de92179553b9377a25649c01eb5ac7d547c29cc964e69ede7f2af9fc677508a99251fff
SSDEEP 3072:skMBALakDeiwKcfFJwwGgl0azGFcjooCmsvKgEpzGCUKVcqJo:skbmYwKc9JT0HFMpzG5KOF
MD5 SHA1 SHA512 SSDEEP

Submit Download

2-5-2025.exe

Path C:\Windows\SysWOW64\2-5-2025.exe
Size 9.4MB
SHA256 7c785cf64a40e49a2a66a301cabd6423cc3bac573a98384f9cf7a097e4bfaf80
MD5 6dc90072eb204ef90ea89a5418a97530
SHA1 efee75fff93fe7041b3473d964d9441855e9f019
SHA512 c5bfc2b813050381f7af548550f48d8161ea7b65d0bb3790647852d1f1ac280ff8641d94e61446aea1401f11d54f8397eaba21017f3560e21dc980828ba43ea2
SSDEEP 98304:HGyqWyWy0GyqWyWyMRPC1eHL5dGYSEYvZ:A1eHL5dEvZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

2-5-2025.exe

Path C:\Windows\SysWOW64\2-5-2025.exe
Size 9.4MB
SHA256 f095acedbace313ee222b67db3b91c66275274af85e7bd6db11d617b55a0e393
MD5 341e163b932711ba0a9ff245521009ee
SHA1 47ac12695254f63927a0275ef2481ec0f61c355d
SHA512 4705f2c0712ea9de33c9846296f7d92a6c4ee49ed3d1dbc039de54eacb49faaeb75ea331015c3a6ca25751a79f027d74779127f923b19294bd68d00b017cc83a
SSDEEP 98304:fGyqWyWy0GyqWyWyMRPC1eHL5dGYSEYvZ:o1eHL5dEvZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

2-5-2025.exe

Path C:\Windows\SysWOW64\2-5-2025.exe
Size 9.4MB
SHA256 577b7aaff4e402e3e9a8779fc3305cf1e41fd3415761cffda1ad86733ad8becd
MD5 80f687f227056910176754808495ab6c
SHA1 2077208eb21c98f994a457f48b406e545f4205ad
SHA512 9e39eb23f929775ded0852c0c1ff97a483f92431c8ce6894dcd1edda084fbe11282ee505a832aae1d3002a43a01a4a4a207bee07bb36228b422edb72b421528a
SSDEEP 98304:VGyqWyWy0GyqWyWyMRPC1eHL5dGYSEYvZ:W1eHL5dEvZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

2-5-2025.exe

Path C:\Windows\SysWOW64\2-5-2025.exe
Size 9.4MB
SHA256 6e228e94f462142c654291f51a5557c2172750ccb3fcc6502a29ec448fb058bb
MD5 4f3261052bd561aa4268d546a29ff88d
SHA1 925e6f14ac0f15bde82337b083b186d43222b1af
SHA512 a195c98e7776dff6bbee44bf726db098b0c4eae83f64eed1e49f67cb882fe4d51382d78d405a31c8f128bf426e88cd5114acebf6a7eb7b78c203bace1b60bcb7
SSDEEP 98304:fGyqWyWy0GyqWyWyMRPC1eHL5dGYSEYvZ:o1eHL5dEvZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Desktop.ini

Path C:\Windows\SysWOW64\Desktop.ini
Size 65B
SHA256 ba8159d865d106e7b4d0043007a63d1541e1de455dc8d7ff0edd3013bd425c62
MD5 64acfa7e03b01f48294cf30d201a0026
SHA1 10facd995b38a095f30b4a800fa454c0bcbf8438
SHA512 65a9b2e639de74a2a7faa83463a03f5f5b526495e3c793ec1e144c422ed0b842dd304cd5ff4f8aec3d76d826507030c5916f70a231429cea636ec2d8ab43931a
MD5 SHA1 SHA512

Submit Download

Kazekage.exe

Path C:\Windows\SysWOW64\drivers\Kazekage.exe
Size 9.4MB
SHA256 d6674150318caaaf9f34b3c0934823d9d7a50b3ac1a2d3e85e0ec7c73d349779
MD5 a3d6d74e627c4aa70f723c9f60f720b7
SHA1 5d0f6e14cb581dacdef87307570b73c73441d625
SHA512 c1e8fe12834140736c55f68acb9c741fe19913bd4e1a3b678f228e3131f6349332174bf714280735c23c97cf7d0827acab61d188e42192467faaf866f5822145
SSDEEP 98304:jGyqWyWy0GyqWyWyMRPC1eHL5dGYSEYvZ:s1eHL5dEvZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Kazekage.exe

Path C:\Windows\SysWOW64\drivers\Kazekage.exe
Size 576KB
SHA256 7c81ba4e5e8018706cc43d3aa3a0faf4b50fbfa93c22b89891188e93e5cb482a
MD5 69f9ceb91333b387eabc99d01472204d
SHA1 fdc2229edea2883035b8e93756f08aa7060f8966
SHA512 692a69688ac5b3bf694726870606d4bc02c968d3138b3f06e1331e82b46c5da7718d60db277047f903e79168fc83566c630e3a7fc318d50d19ca36a5e12f8ccb
SSDEEP 12288:tVG84YqVG84YmVG84YeVG84Y6VG84Y2VG84YqVG84YWVG84YIVG84o:tVG8gVG8UVG88VG8wVG8cVG8QVG8kVGn
MD5 SHA1 SHA512 SSDEEP

Submit Download

Kazekage.exe

Path C:\Windows\SysWOW64\drivers\Kazekage.exe
Size 9.4MB
SHA256 cb6a28e95edb468b541d8dd76ea70ccbd2923ee9c1f3dcdffda3c41af287f1de
MD5 85a3c95d9a18f4c4615f775ddc5c754e
SHA1 b078d17fdc90be99ebae7b3f66427cb4f124325c
SHA512 f28f216dc508b1d519b092b7d14cb8b1270c39e1d5668dd66c7fb9a5a4fe741e5cf44838f8160365273b350c888bf45d84830eb4a8553f7b8fd96483c551bd2c
SSDEEP 98304:rGyqWyWy0GyqWyWyMRPC1eHL5dGYSEYvZ:k1eHL5dEvZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

system32.exe

Path C:\Windows\SysWOW64\drivers\system32.exe
Size 9.4MB
SHA256 13fbf41531206ceb3008ddca18d58982743e3674dd497ac01e82ff35d7f722ef
MD5 51f5f7c7ea4453e6794257094d2ac915
SHA1 32eb23bdec2c1bc252c153815e4415d95770b4bf
SHA512 2c0ee4c731cb8d0127aa344788455d93783d50aeab721a547e8af12a5977ec2eadd0bef410f3789e8eb0bc05a7bc732f9004edccea4ff82a3288bcdb45393aba
SSDEEP 98304:vGyqWyWy0GyqWyWyMRPC1eHL5dGYSEYvZ:41eHL5dEvZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

system32.exe

Path C:\Windows\SysWOW64\drivers\system32.exe
Size 9.4MB
SHA256 b8e2ed2763a90bd4a64878fb84675eb0b5c477643bab44f91928adb2310ddc45
MD5 a241d9dc24ed8539de0f39e1a30b457c
SHA1 cfe56bc52932d7be6e093d8c4d71ee0731f00db7
SHA512 4c5896a887498ef6b4897ed87a2bc2f40b51b3c3461db31bb7787308625ce51cdeb0e2916731ba674c7f2ef68d63dc8c39796a6174452f21edd972a5ed78386d
SSDEEP 98304:pGyqWyWy0GyqWyWyMRPC1eHL5dGYSEYvZ:q1eHL5dEvZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

system32.exe

Path C:\Windows\SysWOW64\drivers\system32.exe
Size 9.4MB
SHA256 55fb21092f95582885b58c6433b6beb4903a35d64e2aa2f5495656e8acd0bd80
MD5 68f26626d4a6156bf7a51b665af3d351
SHA1 b5b34244c711b8afc048833dd8aa4433bc68c8f8
SHA512 e3415356dbedf10c9fc78fa53ff19184c9664a5431e61255fd0315e557db6f51bc4e238dab0549225ac680293c822ea944406932449099ab497db26421f5949e
SSDEEP 98304:XGyqWyWy0GyqWyWyMRPC1eHL5dGYSEYvZ:Q1eHL5dEvZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

mscomctl.ocx

Path C:\Windows\SysWOW64\mscomctl.ocx
Size 2.1MB
SHA256 94c23db7b04f6b5811dd65321d8a1382204fd478ae27e2a02a8d49bf82e0aa2c
MD5 069c72488a242526acb6b148b9164a74
SHA1 d51fa72a982e633951e0049a19c47b751e7909fe
SHA512 8adbbb905ca263ab2a840ffa1fe06b5b146d5abf336df3bdb13dd1e1b96dcdd87eec764d41fd07f2f32edd3048dcb8fb5c77f56bcac5ca7f4ef610effaee6fc8
SSDEEP 24576:IVG8gVG8UVG88VG8wVG8cVG8QVG8kVG8OVG8gVG8UVG88VG8wVG8cVG8QVG8kVGL:IGyqWyWy0GyqWyWyM
MD5 SHA1 SHA512 SSDEEP

Submit Download

msvbvm60.dll

Path C:\Windows\System\msvbvm60.dll
Size 1.4MB
SHA256 898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2
MD5 25f62c02619174b35851b0e0455b3d94
SHA1 4e8ee85157f1769f6e3f61c0acbe59072209da71
SHA512 f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a
SSDEEP 24576:/NqrWz23mmOittiMQVZb2NOTGTZg2REA7qc+vM597KXNWU8fSV2z3PNGvCQSIjuT:/NQimtzbQVB2PpEVa2XNWUISV20AIq
MD5 SHA1 SHA512 SSDEEP

Submit Download

Hokage-Sampit (Nothing).exe

Path F:\Admin Games\Hokage-Sampit (Nothing).exe
Size 9.4MB
SHA256 630ce7385f57eaeaf92ca93b501d190eb1943f9cc5a3f8bd4a32fdd1f0d29d46
MD5 29b4d349e9dd6569e50453aadfdfb586
SHA1 0a542fa7cbc575422169499564ad3f4afcb9fc64
SHA512 529a806f10bcd9089aa86c4c1522ad708b3267956dfa7558d2ff94cd4719a8d12a893cf618dbbc98b0f898843d5d9d0886252831fe2cb9050a200e952fdf04d2
SSDEEP 98304:9GyqWyWy0GyqWyWyMRPC1eHL5dGYSEYvZ:u1eHL5dEvZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Naruto games.exe

Path F:\Admin Games\Naruto games.exe
Size 9.4MB
SHA256 3fad6f7db8ee026d9c2c8dd8bbb246ce9027da77937593db3ca2fee2ef63e476
MD5 4fcf5420a21bb7914de226412433cdd1
SHA1 e8f400bdc0ce0bdc39e2cb6e7dca439c21a2106b
SHA512 8003e68b4758f6385d3b5291b3b575f731e5d89fbeba735b804321d9454ba2220ffb47bdfa3e6e4e9268c628ce489f8745cd7b351f240e59272fe9f3d9fc7220
SSDEEP 98304:cGyqWyWy0GyqWyWyMRPC1eHL5dGYSEYvZ:Z1eHL5dEvZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/624-293-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/920-198-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/1088-263-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/1088-240-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/1308-224-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/1472-177-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/1484-32-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/1484-312-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/1484-277-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/1484-496-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/1484-152-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/1908-173-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/1908-189-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/2064-0-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/2064-495-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/2064-127-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/2064-311-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/2180-303-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/2180-291-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/2260-258-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/2260-231-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/2300-305-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/2576-226-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/2632-587-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/2632-309-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/2632-279-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/2632-229-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/2892-194-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/2892-314-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/2892-586-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/2892-239-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/2892-308-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/3312-275-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/3552-172-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/3752-271-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/3948-273-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/4064-306-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/4228-268-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/4344-70-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/4344-78-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/4568-114-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/4568-119-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/4968-175-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/5140-183-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/5140-310-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/5140-122-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/5140-541-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/5560-297-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/6012-161-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/6012-497-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/6012-79-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/6012-307-0x0000000000400000-0x000000000042A000-memory.dmp

Download