4a0a1ecc1e6ee951eda7f8b8944f551558384e7e6cf84b7e1348126271c572fe

Analysis

max time kernel
149s
max time network
128s
platform
windows11-21h2_x64
resource
win11-20250410-en
resource tags

arch:x64arch:x86image:win11-20250410-enlocale:en-usos:windows11-21h2-x64system
submitted
02/05/2025, 10:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2025-05-02_252daf427ff74462bacd78a31277eb08_black-basta_elex_luca-stealer.exe
Size 8.3MB
Sample250502-ml89zaspx6
SHA256 4a0a1ecc1e6ee951eda7f8b8944f551558384e7e6cf84b7e1348126271c572fe
MD5 252daf427ff74462bacd78a31277eb08
SHA1 0eb53676e022d38ea20f2f2290f1781ea7edd527
SHA512 4a49e17b195d74f301cc336922790032bda92dd783f38d1c4f3368d7552dfe520899c6354388496b3fc71e9157fa5d1fd466ce1948ecbf8f521c7a500ba0268b
SSDEEP 49152:9GyqWyWy0GyqWyWyMRPC1eHc785diLvQ8b1gtj:9GyqWyWy0GyqWyWyMRPC1eHL5dGYSW
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

defense_evasion discovery persistence ransomware trojan upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 12 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe"	Gaara.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe"	Kazekage.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe"	system32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe"	system32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe"	Kazekage.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe"	2025-05-02_252daf427ff74462bacd78a31277eb08_black-basta_elex_luca-stealer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe"	2025-05-02_252daf427ff74462bacd78a31277eb08_black-basta_elex_luca-stealer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,drivers\\system32.exe"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, drivers\\csrss.exe"	Gaara.exe

Modifies visibility of file extensions in Explorer 2 TTPs 6 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3664858464-2411077738-2029630556-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	csrss.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3664858464-2411077738-2029630556-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	Gaara.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3664858464-2411077738-2029630556-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	smss.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3664858464-2411077738-2029630556-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	Kazekage.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3664858464-2411077738-2029630556-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	system32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3664858464-2411077738-2029630556-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	2025-05-02_252daf427ff74462bacd78a31277eb08_black-basta_elex_luca-stealer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 6 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3664858464-2411077738-2029630556-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	Gaara.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3664858464-2411077738-2029630556-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	smss.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3664858464-2411077738-2029630556-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	Kazekage.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3664858464-2411077738-2029630556-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	system32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3664858464-2411077738-2029630556-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	2025-05-02_252daf427ff74462bacd78a31277eb08_black-basta_elex_luca-stealer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3664858464-2411077738-2029630556-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	csrss.exe

UAC bypass 3 TTPs 6 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Gaara.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	smss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Kazekage.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	system32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2025-05-02_252daf427ff74462bacd78a31277eb08_black-basta_elex_luca-stealer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe

Disables RegEdit via registry modification 6 IoCs

defense_evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3664858464-2411077738-2029630556-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	smss.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3664858464-2411077738-2029630556-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	Kazekage.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3664858464-2411077738-2029630556-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	system32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3664858464-2411077738-2029630556-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	2025-05-02_252daf427ff74462bacd78a31277eb08_black-basta_elex_luca-stealer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3664858464-2411077738-2029630556-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	csrss.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3664858464-2411077738-2029630556-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	Gaara.exe

Disables use of System Restore points 1 TTPs
defense_evasion

Inhibit System Recovery
T1490

Drops file in Drivers directory 24 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\drivers\Kazekage.exe	2025-05-02_252daf427ff74462bacd78a31277eb08_black-basta_elex_luca-stealer.exe
File opened for modification	C:\Windows\SysWOW64\drivers\system32.exe	2025-05-02_252daf427ff74462bacd78a31277eb08_black-basta_elex_luca-stealer.exe
File opened for modification	C:\Windows\SysWOW64\drivers\system32.exe	Gaara.exe
File opened for modification	C:\Windows\SysWOW64\drivers\Kazekage.exe	csrss.exe
File created	C:\Windows\SysWOW64\drivers\Kazekage.exe	Kazekage.exe
File created	C:\Windows\SysWOW64\drivers\system32.exe	system32.exe
File created	C:\Windows\SysWOW64\drivers\Kazekage.exe	smss.exe
File created	C:\Windows\SysWOW64\drivers\system32.exe	smss.exe
File opened for modification	C:\Windows\SysWOW64\drivers\Kazekage.exe	Gaara.exe
File created	C:\Windows\SysWOW64\drivers\system32.exe	Gaara.exe
File created	C:\Windows\SysWOW64\drivers\Kazekage.exe	csrss.exe
File created	C:\Windows\SysWOW64\drivers\system32.exe	csrss.exe
File created	C:\Windows\SysWOW64\drivers\system32.exe	Kazekage.exe
File created	C:\Windows\SysWOW64\drivers\Kazekage.exe	2025-05-02_252daf427ff74462bacd78a31277eb08_black-basta_elex_luca-stealer.exe
File created	C:\Windows\SysWOW64\drivers\system32.exe	2025-05-02_252daf427ff74462bacd78a31277eb08_black-basta_elex_luca-stealer.exe
File opened for modification	C:\Windows\SysWOW64\drivers\Kazekage.exe	smss.exe
File opened for modification	C:\Windows\SysWOW64\drivers\system32.exe	csrss.exe
File created	C:\Windows\SysWOW64\drivers\Kazekage.exe	system32.exe
File opened for modification	C:\Windows\SysWOW64\drivers\Kazekage.exe	system32.exe
File opened for modification	C:\Windows\SysWOW64\drivers\system32.exe	system32.exe
File created	C:\Windows\SysWOW64\drivers\Kazekage.exe	Gaara.exe
File opened for modification	C:\Windows\SysWOW64\drivers\system32.exe	smss.exe
File opened for modification	C:\Windows\SysWOW64\drivers\Kazekage.exe	Kazekage.exe
File opened for modification	C:\Windows\SysWOW64\drivers\system32.exe	Kazekage.exe

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 64 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HOKAGE4.exe\Debugger = "cmd.exe /c del"	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Obito.exe	Kazekage.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.avi.exe	Kazekage.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HOKAGE4.exe	system32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HokageFile.exe\Debugger = "cmd.exe /c del"	system32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe\Debugger = "drivers\\Kazekage.exe"	2025-05-02_252daf427ff74462bacd78a31277eb08_black-basta_elex_luca-stealer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Thumbs.com	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedt32.exe	Kazekage.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KakashiHatake.exe	system32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspoold.exe\Debugger = "cmd.exe /c del"	2025-05-02_252daf427ff74462bacd78a31277eb08_black-basta_elex_luca-stealer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe	2025-05-02_252daf427ff74462bacd78a31277eb08_black-basta_elex_luca-stealer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "drivers\\Kazekage.exe"	2025-05-02_252daf427ff74462bacd78a31277eb08_black-basta_elex_luca-stealer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe\Debugger = "drivers\\Kazekage.exe"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Obito.exe\Debugger = "cmd.exe /c del"	Kazekage.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Thumbs.com\Debugger = "cmd.exe /c del"	system32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HOKAGE4.exe	Kazekage.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe	Kazekage.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedt32.exe\Debugger = "drivers\\Kazekage.exe"	Kazekage.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.exe\Debugger = "cmd.exe /c del"	system32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Thumbs.com	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedt32.exe\Debugger = "drivers\\Kazekage.exe"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "drivers\\Kazekage.exe"	system32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HokageFile.exe\Debugger = "cmd.exe /c del"	Gaara.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "drivers\\Kazekage.exe"	Gaara.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rin.exe	Kazekage.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe	Kazekage.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe	Gaara.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedt32.exe	system32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	Kazekage.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe\Debugger = "drivers\\Kazekage.exe"	Kazekage.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspool.exe\Debugger = "cmd.exe /c del"	2025-05-02_252daf427ff74462bacd78a31277eb08_black-basta_elex_luca-stealer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HokageFile.exe\Debugger = "cmd.exe /c del"	2025-05-02_252daf427ff74462bacd78a31277eb08_black-basta_elex_luca-stealer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe	Gaara.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe\Debugger = "drivers\\Kazekage.exe"	Gaara.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspool.exe	Kazekage.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KakashiHatake.exe	Kazekage.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "drivers\\Kazekage.exe"	Kazekage.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspool.exe	2025-05-02_252daf427ff74462bacd78a31277eb08_black-basta_elex_luca-stealer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe	Gaara.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe	Gaara.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.avi.exe\Debugger = "cmd.exe /c del"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rin.exe\Debugger = "cmd.exe /c del"	system32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	2025-05-02_252daf427ff74462bacd78a31277eb08_black-basta_elex_luca-stealer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedt32.exe\Debugger = "drivers\\Kazekage.exe"	Gaara.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HokageFile.exe	Gaara.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "drivers\\Kazekage.exe"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe\Debugger = "cmd.exe /c del"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedt32.exe\Debugger = "drivers\\Kazekage.exe"	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe	Gaara.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedt32.exe\Debugger = "drivers\\Kazekage.exe"	system32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe\Debugger = "cmd.exe /c del"	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe	Kazekage.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.exe	system32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KakashiHatake.exe\Debugger = "cmd.exe /c del"	Kazekage.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Funny UST Scandal.exe	Kazekage.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Obito.exe\Debugger = "cmd.exe /c del"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "drivers\\Kazekage.exe"	2025-05-02_252daf427ff74462bacd78a31277eb08_black-basta_elex_luca-stealer.exe

Executes dropped EXE 30 IoCs

pid	Process
4652	smss.exe
4356	smss.exe
3148	Gaara.exe
972	smss.exe
4732	Gaara.exe
3452	csrss.exe
1000	smss.exe
3504	Gaara.exe
1524	csrss.exe
4772	Kazekage.exe
1296	smss.exe
3020	Gaara.exe
2360	csrss.exe
4980	Kazekage.exe
2988	system32.exe
4488	smss.exe
4956	Gaara.exe
2592	csrss.exe
5060	Kazekage.exe
2348	system32.exe
4220	system32.exe
2736	Kazekage.exe
2796	system32.exe
4216	csrss.exe
5056	Kazekage.exe
4768	system32.exe
5064	Gaara.exe
3936	csrss.exe
544	Kazekage.exe
5000	system32.exe

Loads dropped DLL 18 IoCs

pid	Process
4652	smss.exe
4356	smss.exe
3148	Gaara.exe
972	smss.exe
4732	Gaara.exe
3452	csrss.exe
1000	smss.exe
3504	Gaara.exe
1524	csrss.exe
1296	smss.exe
3020	Gaara.exe
2360	csrss.exe
4488	smss.exe
4956	Gaara.exe
2592	csrss.exe
4216	csrss.exe
5064	Gaara.exe
3936	csrss.exe

Adds Run key to start application 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 2 - 5 - 2025\\Gaara.exe"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 2 - 5 - 2025\\Gaara.exe"	system32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe"	system32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe"	2025-05-02_252daf427ff74462bacd78a31277eb08_black-basta_elex_luca-stealer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 2 - 5 - 2025\\Gaara.exe"	Gaara.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "2-5-2025.exe"	Gaara.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe"	Gaara.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 2 - 5 - 2025\\Gaara.exe"	Kazekage.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 2 - 5 - 2025\\Gaara.exe"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "2-5-2025.exe"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "2-5-2025.exe"	Kazekage.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe"	Kazekage.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 2 - 5 - 2025\\smss.exe"	system32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "2-5-2025.exe"	2025-05-02_252daf427ff74462bacd78a31277eb08_black-basta_elex_luca-stealer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 2 - 5 - 2025\\smss.exe"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "2-5-2025.exe"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 2 - 5 - 2025\\smss.exe"	Gaara.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 2 - 5 - 2025\\smss.exe"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 2 - 5 - 2025\\smss.exe"	Kazekage.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\644r4 = "2-5-2025.exe"	system32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DesertSand = "Fonts\\Admin 2 - 5 - 2025\\smss.exe"	2025-05-02_252daf427ff74462bacd78a31277eb08_black-basta_elex_luca-stealer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FreeAV = "Fonts\\Admin 2 - 5 - 2025\\Gaara.exe"	2025-05-02_252daf427ff74462bacd78a31277eb08_black-basta_elex_luca-stealer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SystemRun = "drivers\\csrss.exe"	csrss.exe

Checks whether UAC is enabled 1 TTPs 6 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2025-05-02_252daf427ff74462bacd78a31277eb08_black-basta_elex_luca-stealer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Gaara.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	smss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Kazekage.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	system32.exe

Drops desktop.ini file(s) 64 IoCs

description	ioc	Process
File opened for modification	\??\R:\Desktop.ini	Kazekage.exe
File opened for modification	\??\Y:\Desktop.ini	smss.exe
File opened for modification	\??\K:\Desktop.ini	Kazekage.exe
File opened for modification	\??\E:\Desktop.ini	system32.exe
File opened for modification	\??\G:\Desktop.ini	system32.exe
File opened for modification	\??\I:\Desktop.ini	Gaara.exe
File opened for modification	\??\K:\Desktop.ini	smss.exe
File opened for modification	\??\A:\Desktop.ini	Kazekage.exe
File opened for modification	\??\J:\Desktop.ini	system32.exe
File opened for modification	\??\O:\Desktop.ini	csrss.exe
File opened for modification	\??\G:\Desktop.ini	Gaara.exe
File opened for modification	\??\P:\Desktop.ini	smss.exe
File opened for modification	\??\N:\Desktop.ini	system32.exe
File opened for modification	\??\U:\Desktop.ini	system32.exe
File opened for modification	\??\Q:\Desktop.ini	2025-05-02_252daf427ff74462bacd78a31277eb08_black-basta_elex_luca-stealer.exe
File opened for modification	\??\T:\Desktop.ini	csrss.exe
File opened for modification	\??\X:\Desktop.ini	csrss.exe
File opened for modification	\??\K:\Desktop.ini	Gaara.exe
File opened for modification	\??\H:\Desktop.ini	smss.exe
File opened for modification	\??\L:\Desktop.ini	system32.exe
File opened for modification	\??\R:\Desktop.ini	system32.exe
File opened for modification	\??\X:\Desktop.ini	2025-05-02_252daf427ff74462bacd78a31277eb08_black-basta_elex_luca-stealer.exe
File opened for modification	\??\Z:\Desktop.ini	csrss.exe
File opened for modification	\??\M:\Desktop.ini	Gaara.exe
File opened for modification	\??\J:\Desktop.ini	Kazekage.exe
File opened for modification	C:\Desktop.ini	system32.exe
File opened for modification	\??\O:\Desktop.ini	system32.exe
File opened for modification	\??\Q:\Desktop.ini	system32.exe
File opened for modification	\??\B:\Desktop.ini	2025-05-02_252daf427ff74462bacd78a31277eb08_black-basta_elex_luca-stealer.exe
File opened for modification	\??\N:\Desktop.ini	Gaara.exe
File opened for modification	\??\Q:\Desktop.ini	Gaara.exe
File opened for modification	\??\R:\Desktop.ini	Gaara.exe
File opened for modification	\??\V:\Desktop.ini	smss.exe
File opened for modification	\??\X:\Desktop.ini	Kazekage.exe
File opened for modification	\??\Z:\Desktop.ini	Kazekage.exe
File opened for modification	\??\G:\Desktop.ini	2025-05-02_252daf427ff74462bacd78a31277eb08_black-basta_elex_luca-stealer.exe
File opened for modification	\??\R:\Desktop.ini	2025-05-02_252daf427ff74462bacd78a31277eb08_black-basta_elex_luca-stealer.exe
File opened for modification	F:\Desktop.ini	Gaara.exe
File opened for modification	\??\U:\Desktop.ini	Gaara.exe
File opened for modification	\??\W:\Desktop.ini	Kazekage.exe
File opened for modification	\??\I:\Desktop.ini	smss.exe
File opened for modification	\??\J:\Desktop.ini	smss.exe
File opened for modification	\??\W:\Desktop.ini	csrss.exe
File opened for modification	\??\O:\Desktop.ini	Gaara.exe
File opened for modification	\??\E:\Desktop.ini	csrss.exe
File opened for modification	\??\A:\Desktop.ini	smss.exe
File opened for modification	\??\N:\Desktop.ini	smss.exe
File opened for modification	\??\Z:\Desktop.ini	smss.exe
File opened for modification	\??\G:\Desktop.ini	Kazekage.exe
File opened for modification	\??\A:\Desktop.ini	Gaara.exe
File opened for modification	\??\B:\Desktop.ini	Gaara.exe
File opened for modification	\??\A:\Desktop.ini	system32.exe
File opened for modification	\??\Y:\Desktop.ini	system32.exe
File opened for modification	\??\Y:\Desktop.ini	Gaara.exe
File opened for modification	\??\M:\Desktop.ini	csrss.exe
File opened for modification	\??\E:\Desktop.ini	Gaara.exe
File opened for modification	\??\S:\Desktop.ini	Gaara.exe
File opened for modification	D:\Desktop.ini	smss.exe
File opened for modification	\??\N:\Desktop.ini	Kazekage.exe
File opened for modification	\??\V:\Desktop.ini	csrss.exe
File opened for modification	\??\V:\Desktop.ini	Gaara.exe
File opened for modification	\??\X:\Desktop.ini	smss.exe
File opened for modification	C:\Desktop.ini	Kazekage.exe
File opened for modification	\??\V:\Desktop.ini	Kazekage.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\T:	csrss.exe
File opened (read-only)	\??\P:	Gaara.exe
File opened (read-only)	\??\R:	Gaara.exe
File opened (read-only)	\??\G:	Kazekage.exe
File opened (read-only)	\??\L:	Kazekage.exe
File opened (read-only)	\??\R:	Kazekage.exe
File opened (read-only)	\??\N:	2025-05-02_252daf427ff74462bacd78a31277eb08_black-basta_elex_luca-stealer.exe
File opened (read-only)	\??\Y:	Gaara.exe
File opened (read-only)	\??\E:	system32.exe
File opened (read-only)	\??\P:	system32.exe
File opened (read-only)	\??\X:	Kazekage.exe
File opened (read-only)	\??\E:	csrss.exe
File opened (read-only)	\??\K:	smss.exe
File opened (read-only)	\??\Z:	smss.exe
File opened (read-only)	\??\I:	Kazekage.exe
File opened (read-only)	\??\W:	Kazekage.exe
File opened (read-only)	\??\N:	system32.exe
File opened (read-only)	\??\Z:	system32.exe
File opened (read-only)	\??\X:	csrss.exe
File opened (read-only)	\??\S:	smss.exe
File opened (read-only)	\??\O:	csrss.exe
File opened (read-only)	\??\E:	smss.exe
File opened (read-only)	\??\S:	Kazekage.exe
File opened (read-only)	\??\K:	system32.exe
File opened (read-only)	\??\L:	csrss.exe
File opened (read-only)	\??\W:	Gaara.exe
File opened (read-only)	\??\X:	Gaara.exe
File opened (read-only)	\??\H:	smss.exe
File opened (read-only)	\??\I:	smss.exe
File opened (read-only)	\??\J:	2025-05-02_252daf427ff74462bacd78a31277eb08_black-basta_elex_luca-stealer.exe
File opened (read-only)	\??\M:	2025-05-02_252daf427ff74462bacd78a31277eb08_black-basta_elex_luca-stealer.exe
File opened (read-only)	\??\P:	csrss.exe
File opened (read-only)	\??\H:	Gaara.exe
File opened (read-only)	\??\I:	Gaara.exe
File opened (read-only)	\??\K:	Gaara.exe
File opened (read-only)	\??\B:	Kazekage.exe
File opened (read-only)	\??\B:	system32.exe
File opened (read-only)	\??\J:	system32.exe
File opened (read-only)	\??\L:	system32.exe
File opened (read-only)	\??\L:	2025-05-02_252daf427ff74462bacd78a31277eb08_black-basta_elex_luca-stealer.exe
File opened (read-only)	\??\H:	Kazekage.exe
File opened (read-only)	\??\U:	Kazekage.exe
File opened (read-only)	\??\K:	csrss.exe
File opened (read-only)	\??\Y:	csrss.exe
File opened (read-only)	\??\O:	Gaara.exe
File opened (read-only)	\??\R:	smss.exe
File opened (read-only)	\??\U:	2025-05-02_252daf427ff74462bacd78a31277eb08_black-basta_elex_luca-stealer.exe
File opened (read-only)	\??\V:	csrss.exe
File opened (read-only)	\??\L:	Gaara.exe
File opened (read-only)	\??\S:	csrss.exe
File opened (read-only)	\??\N:	Gaara.exe
File opened (read-only)	\??\T:	smss.exe
File opened (read-only)	\??\M:	system32.exe
File opened (read-only)	\??\T:	system32.exe
File opened (read-only)	\??\O:	2025-05-02_252daf427ff74462bacd78a31277eb08_black-basta_elex_luca-stealer.exe
File opened (read-only)	\??\L:	smss.exe
File opened (read-only)	\??\W:	2025-05-02_252daf427ff74462bacd78a31277eb08_black-basta_elex_luca-stealer.exe
File opened (read-only)	\??\I:	csrss.exe
File opened (read-only)	\??\Q:	csrss.exe
File opened (read-only)	\??\S:	Gaara.exe
File opened (read-only)	\??\A:	smss.exe
File opened (read-only)	\??\W:	smss.exe
File opened (read-only)	\??\T:	Kazekage.exe
File opened (read-only)	\??\Z:	2025-05-02_252daf427ff74462bacd78a31277eb08_black-basta_elex_luca-stealer.exe

Drops autorun.inf file 1 TTPs 64 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	\??\M:\Autorun.inf	2025-05-02_252daf427ff74462bacd78a31277eb08_black-basta_elex_luca-stealer.exe
File created	\??\H:\Autorun.inf	smss.exe
File created	\??\I:\Autorun.inf	smss.exe
File opened for modification	C:\Autorun.inf	Gaara.exe
File opened for modification	\??\H:\Autorun.inf	2025-05-02_252daf427ff74462bacd78a31277eb08_black-basta_elex_luca-stealer.exe
File opened for modification	\??\V:\Autorun.inf	2025-05-02_252daf427ff74462bacd78a31277eb08_black-basta_elex_luca-stealer.exe
File created	\??\S:\Autorun.inf	smss.exe
File created	\??\O:\Autorun.inf	Gaara.exe
File opened for modification	\??\S:\Autorun.inf	Gaara.exe
File opened for modification	\??\A:\Autorun.inf	csrss.exe
File created	\??\T:\Autorun.inf	csrss.exe
File opened for modification	\??\H:\Autorun.inf	Kazekage.exe
File opened for modification	\??\K:\Autorun.inf	2025-05-02_252daf427ff74462bacd78a31277eb08_black-basta_elex_luca-stealer.exe
File opened for modification	\??\Z:\Autorun.inf	csrss.exe
File created	\??\T:\Autorun.inf	Kazekage.exe
File created	\??\K:\Autorun.inf	system32.exe
File created	\??\E:\Autorun.inf	Gaara.exe
File opened for modification	\??\N:\Autorun.inf	csrss.exe
File created	\??\J:\Autorun.inf	Kazekage.exe
File created	\??\N:\Autorun.inf	Kazekage.exe
File opened for modification	\??\I:\Autorun.inf	system32.exe
File created	D:\Autorun.inf	2025-05-02_252daf427ff74462bacd78a31277eb08_black-basta_elex_luca-stealer.exe
File opened for modification	\??\U:\Autorun.inf	smss.exe
File created	\??\U:\Autorun.inf	smss.exe
File created	\??\X:\Autorun.inf	smss.exe
File opened for modification	\??\E:\Autorun.inf	Gaara.exe
File created	D:\Autorun.inf	Kazekage.exe
File created	F:\Autorun.inf	2025-05-02_252daf427ff74462bacd78a31277eb08_black-basta_elex_luca-stealer.exe
File opened for modification	\??\G:\Autorun.inf	2025-05-02_252daf427ff74462bacd78a31277eb08_black-basta_elex_luca-stealer.exe
File created	\??\J:\Autorun.inf	smss.exe
File created	\??\B:\Autorun.inf	csrss.exe
File opened for modification	\??\Q:\Autorun.inf	system32.exe
File opened for modification	\??\U:\Autorun.inf	system32.exe
File created	\??\W:\Autorun.inf	system32.exe
File opened for modification	\??\Y:\Autorun.inf	Gaara.exe
File created	\??\U:\Autorun.inf	csrss.exe
File created	D:\Autorun.inf	system32.exe
File opened for modification	\??\Z:\Autorun.inf	Kazekage.exe
File opened for modification	\??\S:\Autorun.inf	smss.exe
File opened for modification	\??\B:\Autorun.inf	Gaara.exe
File created	\??\S:\Autorun.inf	Gaara.exe
File opened for modification	C:\Autorun.inf	Kazekage.exe
File opened for modification	\??\A:\Autorun.inf	smss.exe
File created	\??\G:\Autorun.inf	csrss.exe
File created	\??\I:\Autorun.inf	Kazekage.exe
File opened for modification	\??\O:\Autorun.inf	Kazekage.exe
File created	\??\Z:\Autorun.inf	smss.exe
File opened for modification	D:\Autorun.inf	Gaara.exe
File created	\??\O:\Autorun.inf	2025-05-02_252daf427ff74462bacd78a31277eb08_black-basta_elex_luca-stealer.exe
File created	D:\Autorun.inf	smss.exe
File opened for modification	\??\M:\Autorun.inf	smss.exe
File opened for modification	\??\Y:\Autorun.inf	smss.exe
File created	\??\I:\Autorun.inf	csrss.exe
File opened for modification	\??\Y:\Autorun.inf	Kazekage.exe
File opened for modification	\??\P:\Autorun.inf	2025-05-02_252daf427ff74462bacd78a31277eb08_black-basta_elex_luca-stealer.exe
File opened for modification	\??\H:\Autorun.inf	Gaara.exe
File opened for modification	\??\I:\Autorun.inf	Gaara.exe
File opened for modification	\??\J:\Autorun.inf	system32.exe
File created	\??\M:\Autorun.inf	system32.exe
File opened for modification	\??\N:\Autorun.inf	smss.exe
File created	\??\P:\Autorun.inf	Gaara.exe
File created	\??\P:\Autorun.inf	system32.exe
File created	\??\X:\Autorun.inf	system32.exe
File created	\??\R:\Autorun.inf	2025-05-02_252daf427ff74462bacd78a31277eb08_black-basta_elex_luca-stealer.exe

Drops file in System32 directory 39 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\	csrss.exe
File opened for modification	C:\Windows\SysWOW64\Desktop.ini	Kazekage.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	system32.exe
File opened for modification	C:\Windows\SysWOW64\2-5-2025.exe	2025-05-02_252daf427ff74462bacd78a31277eb08_black-basta_elex_luca-stealer.exe
File opened for modification	C:\Windows\SysWOW64\2-5-2025.exe	smss.exe
File opened for modification	C:\Windows\SysWOW64\mscomctl.ocx	smss.exe
File opened for modification	C:\Windows\SysWOW64\mscomctl.ocx	Kazekage.exe
File opened for modification	C:\Windows\SysWOW64\2-5-2025.exe	Kazekage.exe
File created	C:\Windows\SysWOW64\Desktop.ini	2025-05-02_252daf427ff74462bacd78a31277eb08_black-basta_elex_luca-stealer.exe
File created	C:\Windows\SysWOW64\mscomctl.ocx	2025-05-02_252daf427ff74462bacd78a31277eb08_black-basta_elex_luca-stealer.exe
File opened for modification	C:\Windows\SysWOW64\mscomctl.ocx	Gaara.exe
File opened for modification	C:\Windows\SysWOW64\Desktop.ini	system32.exe
File opened for modification	C:\Windows\SysWOW64\	system32.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	2025-05-02_252daf427ff74462bacd78a31277eb08_black-basta_elex_luca-stealer.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	csrss.exe
File opened for modification	C:\Windows\SysWOW64\	smss.exe
File opened for modification	C:\Windows\SysWOW64\mscomctl.ocx	csrss.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	Kazekage.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	Gaara.exe
File opened for modification	C:\Windows\SysWOW64\2-5-2025.exe	csrss.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	Kazekage.exe
File opened for modification	C:\Windows\SysWOW64\mscomctl.ocx	2025-05-02_252daf427ff74462bacd78a31277eb08_black-basta_elex_luca-stealer.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	2025-05-02_252daf427ff74462bacd78a31277eb08_black-basta_elex_luca-stealer.exe
File opened for modification	C:\Windows\SysWOW64\Desktop.ini	2025-05-02_252daf427ff74462bacd78a31277eb08_black-basta_elex_luca-stealer.exe
File opened for modification	C:\Windows\SysWOW64\Desktop.ini	Gaara.exe
File opened for modification	C:\Windows\SysWOW64\	Kazekage.exe
File opened for modification	C:\Windows\SysWOW64\mscomctl.ocx	system32.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	smss.exe
File opened for modification	C:\Windows\SysWOW64\2-5-2025.exe	Gaara.exe
File opened for modification	C:\Windows\SysWOW64\Desktop.ini	smss.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	smss.exe
File created	C:\Windows\SysWOW64\2-5-2025.exe	2025-05-02_252daf427ff74462bacd78a31277eb08_black-basta_elex_luca-stealer.exe
File opened for modification	C:\Windows\SysWOW64\2-5-2025.exe	system32.exe
File opened for modification	C:\Windows\SysWOW64\	2025-05-02_252daf427ff74462bacd78a31277eb08_black-basta_elex_luca-stealer.exe
File opened for modification	C:\Windows\SysWOW64\	Gaara.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	csrss.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	system32.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	Gaara.exe
File opened for modification	C:\Windows\SysWOW64\Desktop.ini	csrss.exe

Sets desktop wallpaper using registry 2 TTPs 6 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3664858464-2411077738-2029630556-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg"	smss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3664858464-2411077738-2029630556-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg"	Gaara.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3664858464-2411077738-2029630556-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg"	csrss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3664858464-2411077738-2029630556-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg"	Kazekage.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3664858464-2411077738-2029630556-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg"	system32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3664858464-2411077738-2029630556-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg"	2025-05-02_252daf427ff74462bacd78a31277eb08_black-basta_elex_luca-stealer.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3356-0-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/files/0x001900000002b1bb-11.dat	upx
behavioral2/files/0x001a00000002b1b9-31.dat	upx
behavioral2/memory/4652-32-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/files/0x001900000002b1bc-49.dat	upx
behavioral2/memory/4356-70-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/4356-74-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/files/0x001900000002b1ba-77.dat	upx
behavioral2/memory/3148-79-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/files/0x001900000002b1bc-90.dat	upx
behavioral2/files/0x001900000002b1bc-89.dat	upx
behavioral2/files/0x001900000002b1bd-93.dat	upx
behavioral2/memory/972-112-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/4732-116-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/4732-120-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/files/0x001900000002b1bb-122.dat	upx
behavioral2/memory/3452-123-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/1000-152-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/3504-158-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/1524-166-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/3356-165-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/3504-164-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/1524-170-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/files/0x001900000002b1bd-174.dat	upx
behavioral2/memory/4772-175-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/4652-173-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/files/0x001900000002b1bc-181.dat	upx
behavioral2/files/0x001900000002b1be-186.dat	upx
behavioral2/memory/2360-208-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/3020-210-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/3148-207-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/4980-215-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/4980-219-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/2988-222-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/3452-241-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/4956-247-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/5060-254-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/4772-255-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/2348-259-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/4220-263-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/2736-270-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/2796-274-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/2988-277-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/4216-279-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/4768-282-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/5056-284-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/4768-288-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/5064-292-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/3936-296-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/544-297-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/5000-301-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/544-302-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/5000-304-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/3356-305-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/4652-306-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/3148-307-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/3452-308-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/4772-309-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/2988-310-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/3356-311-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/3148-313-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/3356-372-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/3148-456-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral2/memory/3452-498-0x0000000000400000-0x000000000042A000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\Fonts\Admin 2 - 5 - 2025\smss.exe	system32.exe
File opened for modification	C:\Windows\system\mscoree.dll	Gaara.exe
File opened for modification	C:\Windows\Fonts\Admin 2 - 5 - 2025\csrss.exe	csrss.exe
File created	C:\Windows\Fonts\Admin 2 - 5 - 2025\msvbvm60.dll	Kazekage.exe
File created	C:\Windows\mscomctl.ocx	2025-05-02_252daf427ff74462bacd78a31277eb08_black-basta_elex_luca-stealer.exe
File opened for modification	C:\Windows\mscomctl.ocx	Kazekage.exe
File opened for modification	C:\Windows\Fonts\Admin 2 - 5 - 2025\Gaara.exe	2025-05-02_252daf427ff74462bacd78a31277eb08_black-basta_elex_luca-stealer.exe
File created	C:\Windows\Fonts\Admin 2 - 5 - 2025\msvbvm60.dll	smss.exe
File created	C:\Windows\Fonts\Admin 2 - 5 - 2025\Gaara.exe	Kazekage.exe
File opened for modification	C:\Windows\system\mscoree.dll	system32.exe
File opened for modification	C:\Windows\system\msvbvm60.dll	system32.exe
File opened for modification	C:\Windows\mscomctl.ocx	2025-05-02_252daf427ff74462bacd78a31277eb08_black-basta_elex_luca-stealer.exe
File opened for modification	C:\Windows\	2025-05-02_252daf427ff74462bacd78a31277eb08_black-basta_elex_luca-stealer.exe
File opened for modification	C:\Windows\	smss.exe
File opened for modification	C:\Windows\Fonts\The Kazekage.jpg	2025-05-02_252daf427ff74462bacd78a31277eb08_black-basta_elex_luca-stealer.exe
File created	C:\Windows\Fonts\Admin 2 - 5 - 2025\csrss.exe	csrss.exe
File opened for modification	C:\Windows\system\msvbvm60.dll	csrss.exe
File opened for modification	C:\Windows\mscomctl.ocx	system32.exe
File created	C:\Windows\Fonts\Admin 2 - 5 - 2025\Gaara.exe	2025-05-02_252daf427ff74462bacd78a31277eb08_black-basta_elex_luca-stealer.exe
File opened for modification	C:\Windows\Fonts\Admin 2 - 5 - 2025\smss.exe	smss.exe
File created	C:\Windows\Fonts\Admin 2 - 5 - 2025\csrss.exe	Gaara.exe
File opened for modification	C:\Windows\	csrss.exe
File opened for modification	C:\Windows\msvbvm60.dll	smss.exe
File created	C:\Windows\WBEM\msvbvm60.dll	Gaara.exe
File opened for modification	C:\Windows\system\mscoree.dll	Kazekage.exe
File opened for modification	C:\Windows\Fonts\Admin 2 - 5 - 2025\csrss.exe	Kazekage.exe
File created	C:\Windows\WBEM\msvbvm60.dll	system32.exe
File opened for modification	C:\Windows\mscomctl.ocx	csrss.exe
File created	C:\Windows\Fonts\Admin 2 - 5 - 2025\csrss.exe	2025-05-02_252daf427ff74462bacd78a31277eb08_black-basta_elex_luca-stealer.exe
File created	C:\Windows\WBEM\msvbvm60.dll	smss.exe
File created	C:\Windows\Fonts\Admin 2 - 5 - 2025\Gaara.exe	csrss.exe
File opened for modification	C:\Windows\	system32.exe
File created	C:\Windows\Fonts\The Kazekage.jpg	2025-05-02_252daf427ff74462bacd78a31277eb08_black-basta_elex_luca-stealer.exe
File opened for modification	C:\Windows\Fonts\Admin 2 - 5 - 2025\smss.exe	2025-05-02_252daf427ff74462bacd78a31277eb08_black-basta_elex_luca-stealer.exe
File created	C:\Windows\WBEM\msvbvm60.dll	2025-05-02_252daf427ff74462bacd78a31277eb08_black-basta_elex_luca-stealer.exe
File opened for modification	C:\Windows\system\mscoree.dll	smss.exe
File opened for modification	C:\Windows\Fonts\Admin 2 - 5 - 2025\Gaara.exe	Gaara.exe
File created	C:\Windows\Fonts\Admin 2 - 5 - 2025\msvbvm60.dll	csrss.exe
File opened for modification	C:\Windows\Fonts\Admin 2 - 5 - 2025\Gaara.exe	Kazekage.exe
File created	C:\Windows\WBEM\msvbvm60.dll	Kazekage.exe
File opened for modification	C:\Windows\Fonts\Admin 2 - 5 - 2025\Gaara.exe	smss.exe
File created	C:\Windows\Fonts\Admin 2 - 5 - 2025\Gaara.exe	system32.exe
File opened for modification	C:\Windows\	Gaara.exe
File created	C:\Windows\Fonts\Admin 2 - 5 - 2025\Gaara.exe	Gaara.exe
File created	C:\Windows\Fonts\Admin 2 - 5 - 2025\msvbvm60.dll	Gaara.exe
File opened for modification	C:\Windows\system\msvbvm60.dll	Gaara.exe
File opened for modification	C:\Windows\Fonts\Admin 2 - 5 - 2025\Gaara.exe	system32.exe
File created	C:\Windows\Fonts\Admin 2 - 5 - 2025\csrss.exe	system32.exe
File created	C:\Windows\Fonts\Admin 2 - 5 - 2025\Gaara.exe	smss.exe
File created	C:\Windows\Fonts\Admin 2 - 5 - 2025\csrss.exe	smss.exe
File created	C:\Windows\Fonts\Admin 2 - 5 - 2025\smss.exe	smss.exe
File opened for modification	C:\Windows\mscomctl.ocx	smss.exe
File opened for modification	C:\Windows\Fonts\Admin 2 - 5 - 2025\csrss.exe	smss.exe
File opened for modification	C:\Windows\system\mscoree.dll	2025-05-02_252daf427ff74462bacd78a31277eb08_black-basta_elex_luca-stealer.exe
File created	C:\Windows\Fonts\Admin 2 - 5 - 2025\smss.exe	2025-05-02_252daf427ff74462bacd78a31277eb08_black-basta_elex_luca-stealer.exe
File opened for modification	C:\Windows\msvbvm60.dll	2025-05-02_252daf427ff74462bacd78a31277eb08_black-basta_elex_luca-stealer.exe
File created	C:\Windows\system\msvbvm60.dll	2025-05-02_252daf427ff74462bacd78a31277eb08_black-basta_elex_luca-stealer.exe
File opened for modification	C:\Windows\system\msvbvm60.dll	2025-05-02_252daf427ff74462bacd78a31277eb08_black-basta_elex_luca-stealer.exe
File opened for modification	C:\Windows\msvbvm60.dll	Gaara.exe
File created	C:\Windows\WBEM\msvbvm60.dll	csrss.exe
File created	C:\Windows\Fonts\Admin 2 - 5 - 2025\smss.exe	Kazekage.exe
File opened for modification	C:\Windows\msvbvm60.dll	Kazekage.exe
File opened for modification	C:\Windows\system\msvbvm60.dll	Kazekage.exe
File opened for modification	C:\Windows\Fonts\Admin 2 - 5 - 2025\smss.exe	system32.exe

System Location Discovery: System Language Discovery 1 TTPs 63 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gaara.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kazekage.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gaara.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kazekage.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2025-05-02_252daf427ff74462bacd78a31277eb08_black-basta_elex_luca-stealer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gaara.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kazekage.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gaara.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kazekage.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gaara.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kazekage.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gaara.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kazekage.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 32 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3444	ping.exe
3752	ping.exe
1132	ping.exe
2320	ping.exe
4288	ping.exe
544	ping.exe
2996	ping.exe
4436	ping.exe
5092	ping.exe
3396	ping.exe
4304	ping.exe
1676	ping.exe
4044	ping.exe
4428	ping.exe
436	ping.exe
1300	ping.exe
4356	ping.exe
492	ping.exe
4604	ping.exe
488	ping.exe
1020	ping.exe
1324	ping.exe
3508	ping.exe
4100	ping.exe
3728	ping.exe
3760	ping.exe
132	ping.exe
4740	ping.exe
1460	ping.exe
956	ping.exe
4972	ping.exe
4664	ping.exe

Modifies Control Panel 64 IoCs

defense_evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3664858464-2411077738-2029630556-1000\Control Panel\Desktop	system32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3664858464-2411077738-2029630556-1000\Control Panel\Desktop\SCRNSAVE.EXE = "ssmarque.scr"	smss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3664858464-2411077738-2029630556-1000\Control Panel\Screen Saver.Marquee\Text = "Gaara The Kazekage ( Warning : don't save any porn stuffs files in this computer )"	Gaara.exe
Key created	\REGISTRY\USER\S-1-5-21-3664858464-2411077738-2029630556-1000\Control Panel\Desktop	csrss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3664858464-2411077738-2029630556-1000\Control Panel\Desktop\ConvertedWallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg"	csrss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3664858464-2411077738-2029630556-1000\Control Panel\Desktop\WallpaperStyle = "2"	csrss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3664858464-2411077738-2029630556-1000\Control Panel\Desktop\WallpaperStyle = "2"	smss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3664858464-2411077738-2029630556-1000\Control Panel\Desktop\ConvertedWallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg"	Kazekage.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3664858464-2411077738-2029630556-1000\Control Panel\Desktop\ConvertedWallpaper = "Fonts\\The Kazekage.jpg"	Kazekage.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3664858464-2411077738-2029630556-1000\Control Panel\Desktop\ConvertedWallpaper = "Fonts\\The Kazekage.jpg"	system32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3664858464-2411077738-2029630556-1000\Control Panel\Screen Saver.Marquee\Speed = "4"	system32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3664858464-2411077738-2029630556-1000\Control Panel\Desktop\SCRNSAVE.EXE = "ssmarque.scr"	csrss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3664858464-2411077738-2029630556-1000\Control Panel\Screen Saver.Marquee\Font = "Blackadder ITC"	Kazekage.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3664858464-2411077738-2029630556-1000\Control Panel\Screen Saver.Marquee\Speed = "4"	Kazekage.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3664858464-2411077738-2029630556-1000\Control Panel\Desktop\SCRNSAVE.EXE = "ssmarque.scr"	system32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3664858464-2411077738-2029630556-1000\Control Panel\Screen Saver.Marquee\TextColor = "255 0 0"	csrss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3664858464-2411077738-2029630556-1000\Control Panel\Screen Saver.Marquee\Mode.EXE = "1"	Gaara.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3664858464-2411077738-2029630556-1000\Control Panel\Screen Saver.Marquee\Font = "Blackadder ITC"	smss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3664858464-2411077738-2029630556-1000\Control Panel\Screen Saver.Marquee\BackgroundColor = "0 0 0"	2025-05-02_252daf427ff74462bacd78a31277eb08_black-basta_elex_luca-stealer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3664858464-2411077738-2029630556-1000\Control Panel\Screen Saver.Marquee\Speed = "4"	smss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3664858464-2411077738-2029630556-1000\Control Panel\Desktop\ConvertedWallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg"	Gaara.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3664858464-2411077738-2029630556-1000\Control Panel\Screen Saver.Marquee\BackgroundColor = "0 0 0"	Kazekage.exe
Key created	\REGISTRY\USER\S-1-5-21-3664858464-2411077738-2029630556-1000\Control Panel\Desktop	Kazekage.exe
Key created	\REGISTRY\USER\S-1-5-21-3664858464-2411077738-2029630556-1000\Control Panel\Screen Saver.Marquee	smss.exe
Key created	\REGISTRY\USER\S-1-5-21-3664858464-2411077738-2029630556-1000\Control Panel\Screen Saver.Marquee	system32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3664858464-2411077738-2029630556-1000\Control Panel\Screen Saver.Marquee\TextColor = "255 0 0"	system32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3664858464-2411077738-2029630556-1000\Control Panel\Screen Saver.Marquee\Font = "Blackadder ITC"	csrss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3664858464-2411077738-2029630556-1000\Control Panel\Desktop\ConvertedWallpaper = "Fonts\\The Kazekage.jpg"	Gaara.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3664858464-2411077738-2029630556-1000\Control Panel\Screen Saver.Marquee\TextColor = "255 0 0"	Gaara.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3664858464-2411077738-2029630556-1000\Control Panel\Screen Saver.Marquee\BackgroundColor = "0 0 0"	smss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3664858464-2411077738-2029630556-1000\Control Panel\Screen Saver.Marquee\Text = "Gaara The Kazekage ( Warning : don't save any porn stuffs files in this computer )"	smss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3664858464-2411077738-2029630556-1000\Control Panel\Desktop\SCRNSAVE.EXE = "ssmarque.scr"	Kazekage.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3664858464-2411077738-2029630556-1000\Control Panel\Screen Saver.Marquee\Size = "72"	system32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3664858464-2411077738-2029630556-1000\Control Panel\Screen Saver.Marquee\Text = "Gaara The Kazekage ( Warning : don't save any porn stuffs files in this computer )"	system32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3664858464-2411077738-2029630556-1000\Control Panel\Screen Saver.Marquee\BackgroundColor = "0 0 0"	csrss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3664858464-2411077738-2029630556-1000\Control Panel\Screen Saver.Marquee\Size = "72"	Gaara.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3664858464-2411077738-2029630556-1000\Control Panel\Desktop\ConvertedWallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg"	2025-05-02_252daf427ff74462bacd78a31277eb08_black-basta_elex_luca-stealer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3664858464-2411077738-2029630556-1000\Control Panel\Desktop\ConvertedWallpaper = "C:\\Windows\\Fonts\\The Kazekage.jpg"	system32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3664858464-2411077738-2029630556-1000\Control Panel\Desktop\WallpaperStyle = "2"	system32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3664858464-2411077738-2029630556-1000\Control Panel\Screen Saver.Marquee\Mode.EXE = "1"	Kazekage.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3664858464-2411077738-2029630556-1000\Control Panel\Screen Saver.Marquee\BackgroundColor = "0 0 0"	system32.exe
Key created	\REGISTRY\USER\S-1-5-21-3664858464-2411077738-2029630556-1000\Control Panel\Screen Saver.Marquee	2025-05-02_252daf427ff74462bacd78a31277eb08_black-basta_elex_luca-stealer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3664858464-2411077738-2029630556-1000\Control Panel\Screen Saver.Marquee\Font = "Blackadder ITC"	2025-05-02_252daf427ff74462bacd78a31277eb08_black-basta_elex_luca-stealer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3664858464-2411077738-2029630556-1000\Control Panel\Screen Saver.Marquee\Mode.EXE = "1"	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-3664858464-2411077738-2029630556-1000\Control Panel\Desktop	smss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3664858464-2411077738-2029630556-1000\Control Panel\Desktop\ConvertedWallpaper = "Fonts\\The Kazekage.jpg"	smss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3664858464-2411077738-2029630556-1000\Control Panel\Screen Saver.Marquee\Size = "72"	Kazekage.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3664858464-2411077738-2029630556-1000\Control Panel\Screen Saver.Marquee\Text = "Gaara The Kazekage ( Warning : don't save any porn stuffs files in this computer )"	2025-05-02_252daf427ff74462bacd78a31277eb08_black-basta_elex_luca-stealer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3664858464-2411077738-2029630556-1000\Control Panel\Desktop\SCRNSAVE.EXE = "ssmarque.scr"	Gaara.exe
Key created	\REGISTRY\USER\S-1-5-21-3664858464-2411077738-2029630556-1000\Control Panel\Screen Saver.Marquee	Gaara.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3664858464-2411077738-2029630556-1000\Control Panel\Screen Saver.Marquee\BackgroundColor = "0 0 0"	Gaara.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3664858464-2411077738-2029630556-1000\Control Panel\Screen Saver.Marquee\Font = "Blackadder ITC"	Gaara.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3664858464-2411077738-2029630556-1000\Control Panel\Screen Saver.Marquee\TextColor = "255 0 0"	smss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3664858464-2411077738-2029630556-1000\Control Panel\Screen Saver.Marquee\Size = "72"	2025-05-02_252daf427ff74462bacd78a31277eb08_black-basta_elex_luca-stealer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3664858464-2411077738-2029630556-1000\Control Panel\Screen Saver.Marquee\Size = "72"	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-3664858464-2411077738-2029630556-1000\Control Panel\Desktop	Gaara.exe
Key created	\REGISTRY\USER\S-1-5-21-3664858464-2411077738-2029630556-1000\Control Panel\Screen Saver.Marquee	Kazekage.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3664858464-2411077738-2029630556-1000\Control Panel\Screen Saver.Marquee\Mode.EXE = "1"	system32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3664858464-2411077738-2029630556-1000\Control Panel\Desktop\ConvertedWallpaper = "Fonts\\The Kazekage.jpg"	csrss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3664858464-2411077738-2029630556-1000\Control Panel\Screen Saver.Marquee\Size = "72"	smss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3664858464-2411077738-2029630556-1000\Control Panel\Screen Saver.Marquee\Mode.EXE = "1"	smss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3664858464-2411077738-2029630556-1000\Control Panel\Desktop\ScreenSaveTimeOut = "400"	Kazekage.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3664858464-2411077738-2029630556-1000\Control Panel\Screen Saver.Marquee\Text = "Gaara The Kazekage ( Warning : don't save any porn stuffs files in this computer )"	Kazekage.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3664858464-2411077738-2029630556-1000\Control Panel\Screen Saver.Marquee\Font = "Blackadder ITC"	system32.exe

Modifies Internet Explorer settings 1 TTPs 12 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3664858464-2411077738-2029630556-1000\Software\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!"	Kazekage.exe
Key created	\REGISTRY\USER\S-1-5-21-3664858464-2411077738-2029630556-1000\Software\Microsoft\Internet Explorer\Main	system32.exe
Key created	\REGISTRY\USER\S-1-5-21-3664858464-2411077738-2029630556-1000\Software\Microsoft\Internet Explorer\Main	2025-05-02_252daf427ff74462bacd78a31277eb08_black-basta_elex_luca-stealer.exe
Key created	\REGISTRY\USER\S-1-5-21-3664858464-2411077738-2029630556-1000\Software\Microsoft\Internet Explorer\Main	csrss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3664858464-2411077738-2029630556-1000\Software\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!"	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-3664858464-2411077738-2029630556-1000\Software\Microsoft\Internet Explorer\Main	smss.exe
Key created	\REGISTRY\USER\S-1-5-21-3664858464-2411077738-2029630556-1000\Software\Microsoft\Internet Explorer\Main	Kazekage.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3664858464-2411077738-2029630556-1000\Software\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!"	system32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3664858464-2411077738-2029630556-1000\Software\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!"	2025-05-02_252daf427ff74462bacd78a31277eb08_black-basta_elex_luca-stealer.exe
Key created	\REGISTRY\USER\S-1-5-21-3664858464-2411077738-2029630556-1000\Software\Microsoft\Internet Explorer\Main	Gaara.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3664858464-2411077738-2029630556-1000\Software\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!"	Gaara.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3664858464-2411077738-2029630556-1000\Software\Microsoft\Internet Explorer\Main\Window Title = "!!! Hello HokageFile (AnbuTeam-Sampit), Is this my places, Wanna start a War !!!"	smss.exe

Modifies registry class 51 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command	system32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe"	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command	2025-05-02_252daf427ff74462bacd78a31277eb08_black-basta_elex_luca-stealer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe"	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe"	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command	Gaara.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0"	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe"	system32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe"	2025-05-02_252daf427ff74462bacd78a31277eb08_black-basta_elex_luca-stealer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command	2025-05-02_252daf427ff74462bacd78a31277eb08_black-basta_elex_luca-stealer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command	Gaara.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command	Gaara.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command	system32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command	2025-05-02_252daf427ff74462bacd78a31277eb08_black-basta_elex_luca-stealer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0"	system32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command	2025-05-02_252daf427ff74462bacd78a31277eb08_black-basta_elex_luca-stealer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command	Kazekage.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command	Kazekage.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe"	Kazekage.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command	Kazekage.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe"	system32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe"	2025-05-02_252daf427ff74462bacd78a31277eb08_black-basta_elex_luca-stealer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe"	Kazekage.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command	system32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe"	2025-05-02_252daf427ff74462bacd78a31277eb08_black-basta_elex_luca-stealer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0"	2025-05-02_252daf427ff74462bacd78a31277eb08_black-basta_elex_luca-stealer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe"	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command	Gaara.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "calc.exe"	Gaara.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command\ = "calc.exe"	Gaara.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe"	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile	smss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe"	Kazekage.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0"	Kazekage.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open2\Command	system32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe"	Gaara.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "shutdown -r -f -t 0"	Gaara.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "calc.exe"	system32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command	Kazekage.exe

Runs ping.exe 1 TTPs 32 IoCs

Remote System Discovery

T1018

pid	Process
4288	ping.exe
4356	ping.exe
3752	ping.exe
1132	ping.exe
436	ping.exe
492	ping.exe
3508	ping.exe
3396	ping.exe
1676	ping.exe
4428	ping.exe
488	ping.exe
4664	ping.exe
132	ping.exe
1020	ping.exe
4740	ping.exe
4436	ping.exe
4604	ping.exe
2320	ping.exe
544	ping.exe
3444	ping.exe
4304	ping.exe
4100	ping.exe
1460	ping.exe
4972	ping.exe
1300	ping.exe
3760	ping.exe
1324	ping.exe
3728	ping.exe
5092	ping.exe
956	ping.exe
4044	ping.exe
2996	ping.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4652	smss.exe
4652	smss.exe
4652	smss.exe
4652	smss.exe
4652	smss.exe
4652	smss.exe
4652	smss.exe
4652	smss.exe
4652	smss.exe
4652	smss.exe
4652	smss.exe
4652	smss.exe
4652	smss.exe
4652	smss.exe
4652	smss.exe
4652	smss.exe
4652	smss.exe
4652	smss.exe
4652	smss.exe
4652	smss.exe
4652	smss.exe
4652	smss.exe
4652	smss.exe
4652	smss.exe
4772	Kazekage.exe
4772	Kazekage.exe
4772	Kazekage.exe
4772	Kazekage.exe
4772	Kazekage.exe
4772	Kazekage.exe
4772	Kazekage.exe
4772	Kazekage.exe
4772	Kazekage.exe
4772	Kazekage.exe
4772	Kazekage.exe
4772	Kazekage.exe
4772	Kazekage.exe
4772	Kazekage.exe
4772	Kazekage.exe
4772	Kazekage.exe
4772	Kazekage.exe
4772	Kazekage.exe
4772	Kazekage.exe
4772	Kazekage.exe
4772	Kazekage.exe
4772	Kazekage.exe
4772	Kazekage.exe
4772	Kazekage.exe
2988	system32.exe
2988	system32.exe
2988	system32.exe
2988	system32.exe
2988	system32.exe
2988	system32.exe
2988	system32.exe
2988	system32.exe
2988	system32.exe
2988	system32.exe
2988	system32.exe
2988	system32.exe
2988	system32.exe
2988	system32.exe
2988	system32.exe
2988	system32.exe

Suspicious use of SetWindowsHookEx 30 IoCs

pid	Process
3356	2025-05-02_252daf427ff74462bacd78a31277eb08_black-basta_elex_luca-stealer.exe
4652	smss.exe
4356	smss.exe
3148	Gaara.exe
972	smss.exe
4732	Gaara.exe
3452	csrss.exe
1000	smss.exe
3504	Gaara.exe
1524	csrss.exe
4772	Kazekage.exe
1296	smss.exe
3020	Gaara.exe
2360	csrss.exe
4980	Kazekage.exe
2988	system32.exe
4488	smss.exe
4956	Gaara.exe
2592	csrss.exe
5060	Kazekage.exe
2348	system32.exe
4220	system32.exe
2736	Kazekage.exe
2796	system32.exe
4216	csrss.exe
5056	Kazekage.exe
4768	system32.exe
5064	Gaara.exe
3936	csrss.exe
544	Kazekage.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3356 wrote to memory of 4652	3356	2025-05-02_252daf427ff74462bacd78a31277eb08_black-basta_elex_luca-stealer.exe	78
PID 3356 wrote to memory of 4652	3356	2025-05-02_252daf427ff74462bacd78a31277eb08_black-basta_elex_luca-stealer.exe	78
PID 3356 wrote to memory of 4652	3356	2025-05-02_252daf427ff74462bacd78a31277eb08_black-basta_elex_luca-stealer.exe	78
PID 4652 wrote to memory of 4356	4652	smss.exe	79
PID 4652 wrote to memory of 4356	4652	smss.exe	79
PID 4652 wrote to memory of 4356	4652	smss.exe	79
PID 4652 wrote to memory of 3148	4652	smss.exe	80
PID 4652 wrote to memory of 3148	4652	smss.exe	80
PID 4652 wrote to memory of 3148	4652	smss.exe	80
PID 3148 wrote to memory of 972	3148	Gaara.exe	81
PID 3148 wrote to memory of 972	3148	Gaara.exe	81
PID 3148 wrote to memory of 972	3148	Gaara.exe	81
PID 3148 wrote to memory of 4732	3148	Gaara.exe	82
PID 3148 wrote to memory of 4732	3148	Gaara.exe	82
PID 3148 wrote to memory of 4732	3148	Gaara.exe	82
PID 3148 wrote to memory of 3452	3148	Gaara.exe	83
PID 3148 wrote to memory of 3452	3148	Gaara.exe	83
PID 3148 wrote to memory of 3452	3148	Gaara.exe	83
PID 3452 wrote to memory of 1000	3452	csrss.exe	84
PID 3452 wrote to memory of 1000	3452	csrss.exe	84
PID 3452 wrote to memory of 1000	3452	csrss.exe	84
PID 3452 wrote to memory of 3504	3452	csrss.exe	85
PID 3452 wrote to memory of 3504	3452	csrss.exe	85
PID 3452 wrote to memory of 3504	3452	csrss.exe	85
PID 3452 wrote to memory of 1524	3452	csrss.exe	86
PID 3452 wrote to memory of 1524	3452	csrss.exe	86
PID 3452 wrote to memory of 1524	3452	csrss.exe	86
PID 3452 wrote to memory of 4772	3452	csrss.exe	87
PID 3452 wrote to memory of 4772	3452	csrss.exe	87
PID 3452 wrote to memory of 4772	3452	csrss.exe	87
PID 4772 wrote to memory of 1296	4772	Kazekage.exe	88
PID 4772 wrote to memory of 1296	4772	Kazekage.exe	88
PID 4772 wrote to memory of 1296	4772	Kazekage.exe	88
PID 4772 wrote to memory of 3020	4772	Kazekage.exe	89
PID 4772 wrote to memory of 3020	4772	Kazekage.exe	89
PID 4772 wrote to memory of 3020	4772	Kazekage.exe	89
PID 4772 wrote to memory of 2360	4772	Kazekage.exe	90
PID 4772 wrote to memory of 2360	4772	Kazekage.exe	90
PID 4772 wrote to memory of 2360	4772	Kazekage.exe	90
PID 4772 wrote to memory of 4980	4772	Kazekage.exe	91
PID 4772 wrote to memory of 4980	4772	Kazekage.exe	91
PID 4772 wrote to memory of 4980	4772	Kazekage.exe	91
PID 4772 wrote to memory of 2988	4772	Kazekage.exe	92
PID 4772 wrote to memory of 2988	4772	Kazekage.exe	92
PID 4772 wrote to memory of 2988	4772	Kazekage.exe	92
PID 2988 wrote to memory of 4488	2988	system32.exe	93
PID 2988 wrote to memory of 4488	2988	system32.exe	93
PID 2988 wrote to memory of 4488	2988	system32.exe	93
PID 2988 wrote to memory of 4956	2988	system32.exe	94
PID 2988 wrote to memory of 4956	2988	system32.exe	94
PID 2988 wrote to memory of 4956	2988	system32.exe	94
PID 2988 wrote to memory of 2592	2988	system32.exe	95
PID 2988 wrote to memory of 2592	2988	system32.exe	95
PID 2988 wrote to memory of 2592	2988	system32.exe	95
PID 2988 wrote to memory of 5060	2988	system32.exe	96
PID 2988 wrote to memory of 5060	2988	system32.exe	96
PID 2988 wrote to memory of 5060	2988	system32.exe	96
PID 2988 wrote to memory of 2348	2988	system32.exe	97
PID 2988 wrote to memory of 2348	2988	system32.exe	97
PID 2988 wrote to memory of 2348	2988	system32.exe	97
PID 3452 wrote to memory of 4220	3452	csrss.exe	98
PID 3452 wrote to memory of 4220	3452	csrss.exe	98
PID 3452 wrote to memory of 4220	3452	csrss.exe	98
PID 3148 wrote to memory of 2736	3148	Gaara.exe	99

System policy modification 1 TTPs 12 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	system32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	2025-05-02_252daf427ff74462bacd78a31277eb08_black-basta_elex_luca-stealer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2025-05-02_252daf427ff74462bacd78a31277eb08_black-basta_elex_luca-stealer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	Gaara.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Gaara.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	smss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	smss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	Kazekage.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Kazekage.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	system32.exe

C:\Users\Admin\AppData\Local\Temp\2025-05-02_252daf427ff74462bacd78a31277eb08_black-basta_elex_luca-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2025-05-02_252daf427ff74462bacd78a31277eb08_black-basta_elex_luca-stealer.exe"
1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3356
- C:\Windows\Fonts\Admin 2 - 5 - 2025\smss.exe
  "C:\Windows\Fonts\Admin 2 - 5 - 2025\smss.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - UAC bypass
  - Disables RegEdit via registry modification
  - Drops file in Drivers directory
  - Event Triggered Execution: Image File Execution Options Injection
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Drops desktop.ini file(s)
  - Enumerates connected drives
  - Drops autorun.inf file
  - Drops file in System32 directory
  - Sets desktop wallpaper using registry
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Modifies Control Panel
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:4652
- - C:\Windows\Fonts\Admin 2 - 5 - 2025\smss.exe
    "C:\Windows\Fonts\Admin 2 - 5 - 2025\smss.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4356
- - C:\Windows\Fonts\Admin 2 - 5 - 2025\Gaara.exe
    "C:\Windows\Fonts\Admin 2 - 5 - 2025\Gaara.exe"
    3⤵
    - Modifies WinLogon for persistence
    - Modifies visibility of file extensions in Explorer
    - Modifies visiblity of hidden/system files in Explorer
    - UAC bypass
    - Disables RegEdit via registry modification
    - Drops file in Drivers directory
    - Event Triggered Execution: Image File Execution Options Injection
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Drops desktop.ini file(s)
    - Enumerates connected drives
    - Drops autorun.inf file
    - Drops file in System32 directory
    - Sets desktop wallpaper using registry
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Modifies Control Panel
    - Modifies Internet Explorer settings
    - Modifies registry class
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:3148
  - - C:\Windows\Fonts\Admin 2 - 5 - 2025\smss.exe
      "C:\Windows\Fonts\Admin 2 - 5 - 2025\smss.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:972
  - - C:\Windows\Fonts\Admin 2 - 5 - 2025\Gaara.exe
      "C:\Windows\Fonts\Admin 2 - 5 - 2025\Gaara.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:4732
  - - C:\Windows\Fonts\Admin 2 - 5 - 2025\csrss.exe
      "C:\Windows\Fonts\Admin 2 - 5 - 2025\csrss.exe"
      4⤵
      Modifies WinLogon for persistence
      Modifies visibility of file extensions in Explorer
      Modifies visiblity of hidden/system files in Explorer
      UAC bypass
      Disables RegEdit via registry modification
      Drops file in Drivers directory
      Event Triggered Execution: Image File Execution Options Injection
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Checks whether UAC is enabled
      Drops desktop.ini file(s)
      Enumerates connected drives
      Drops autorun.inf file
      Drops file in System32 directory
      Sets desktop wallpaper using registry
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Modifies Control Panel
      Modifies Internet Explorer settings
      Modifies registry class
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:3452
    - - C:\Windows\Fonts\Admin 2 - 5 - 2025\smss.exe
        
        "C:\Windows\Fonts\Admin 2 - 5 - 2025\smss.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1000
    - - C:\Windows\Fonts\Admin 2 - 5 - 2025\Gaara.exe
        
        "C:\Windows\Fonts\Admin 2 - 5 - 2025\Gaara.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3504
    - - C:\Windows\Fonts\Admin 2 - 5 - 2025\csrss.exe
        
        "C:\Windows\Fonts\Admin 2 - 5 - 2025\csrss.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1524
    - - C:\Windows\SysWOW64\drivers\Kazekage.exe
        
        C:\Windows\system32\drivers\Kazekage.exe
        5⤵
        Modifies WinLogon for persistence
        Modifies visibility of file extensions in Explorer
        Modifies visiblity of hidden/system files in Explorer
        UAC bypass
        Disables RegEdit via registry modification
        Drops file in Drivers directory
        Event Triggered Execution: Image File Execution Options Injection
        Executes dropped EXE
        Adds Run key to start application
        Checks whether UAC is enabled
        Drops desktop.ini file(s)
        Enumerates connected drives
        Drops autorun.inf file
        Drops file in System32 directory
        Sets desktop wallpaper using registry
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Modifies Control Panel
        Modifies Internet Explorer settings
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:4772
      - C:\Windows\Fonts\Admin 2 - 5 - 2025\smss.exe
        
        "C:\Windows\Fonts\Admin 2 - 5 - 2025\smss.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1296
      - C:\Windows\Fonts\Admin 2 - 5 - 2025\Gaara.exe
        
        "C:\Windows\Fonts\Admin 2 - 5 - 2025\Gaara.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3020
      - C:\Windows\Fonts\Admin 2 - 5 - 2025\csrss.exe
        
        "C:\Windows\Fonts\Admin 2 - 5 - 2025\csrss.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2360
      - C:\Windows\SysWOW64\drivers\Kazekage.exe
        
        C:\Windows\system32\drivers\Kazekage.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4980
      - C:\Windows\SysWOW64\drivers\system32.exe
        
        C:\Windows\system32\drivers\system32.exe
        6⤵
        Modifies WinLogon for persistence
        Modifies visibility of file extensions in Explorer
        Modifies visiblity of hidden/system files in Explorer
        UAC bypass
        Disables RegEdit via registry modification
        Drops file in Drivers directory
        Event Triggered Execution: Image File Execution Options Injection
        Executes dropped EXE
        Adds Run key to start application
        Checks whether UAC is enabled
        Drops desktop.ini file(s)
        Enumerates connected drives
        Drops autorun.inf file
        Drops file in System32 directory
        Sets desktop wallpaper using registry
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Modifies Control Panel
        Modifies Internet Explorer settings
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:2988
        
        C:\Windows\Fonts\Admin 2 - 5 - 2025\smss.exe
        
        "C:\Windows\Fonts\Admin 2 - 5 - 2025\smss.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4488
        
        C:\Windows\Fonts\Admin 2 - 5 - 2025\Gaara.exe
        
        "C:\Windows\Fonts\Admin 2 - 5 - 2025\Gaara.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4956
        
        C:\Windows\Fonts\Admin 2 - 5 - 2025\csrss.exe
        
        "C:\Windows\Fonts\Admin 2 - 5 - 2025\csrss.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2592
        
        C:\Windows\SysWOW64\drivers\Kazekage.exe
        
        C:\Windows\system32\drivers\Kazekage.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:5060
        
        C:\Windows\SysWOW64\drivers\system32.exe
        
        C:\Windows\system32\drivers\system32.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2348
        
        C:\Windows\SysWOW64\ping.exe
        
        ping -a -l www.rasasayang.com.my 65500
        7⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4356
        
        C:\Windows\SysWOW64\ping.exe
        
        ping -a -l www.duniasex.com 65500
        7⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4304
        
        C:\Windows\SysWOW64\ping.exe
        
        ping -a -l www.rasasayang.com.my 65500
        7⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4604
        
        C:\Windows\SysWOW64\ping.exe
        
        ping -a -l www.duniasex.com 65500
        7⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:488
        
        C:\Windows\SysWOW64\ping.exe
        
        ping -a -l www.rasasayang.com.my 65500
        7⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1324
        
        C:\Windows\SysWOW64\ping.exe
        
        ping -a -l www.duniasex.com 65500
        7⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5092
      - C:\Windows\SysWOW64\ping.exe
        
        ping -a -l www.rasasayang.com.my 65500
        6⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:436
      - C:\Windows\SysWOW64\ping.exe
        
        ping -a -l www.duniasex.com 65500
        6⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1300
      - C:\Windows\SysWOW64\ping.exe
        
        ping -a -l www.rasasayang.com.my 65500
        6⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2320
      - C:\Windows\SysWOW64\ping.exe
        
        ping -a -l www.duniasex.com 65500
        6⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1460
    - - C:\Windows\SysWOW64\drivers\system32.exe
        
        C:\Windows\system32\drivers\system32.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4220
    - - C:\Windows\SysWOW64\ping.exe
        
        ping -a -l www.rasasayang.com.my 65500
        5⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3444
    - - C:\Windows\SysWOW64\ping.exe
        
        ping -a -l www.duniasex.com 65500
        5⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4428
    - - C:\Windows\SysWOW64\ping.exe
        
        ping -a -l www.rasasayang.com.my 65500
        5⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1132
    - - C:\Windows\SysWOW64\ping.exe
        
        ping -a -l www.duniasex.com 65500
        5⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3752
  - - C:\Windows\SysWOW64\drivers\Kazekage.exe
      C:\Windows\system32\drivers\Kazekage.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2736
  - - C:\Windows\SysWOW64\drivers\system32.exe
      C:\Windows\system32\drivers\system32.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2796
  - - C:\Windows\SysWOW64\ping.exe
      ping -a -l www.rasasayang.com.my 65500
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:4044
  - - C:\Windows\SysWOW64\ping.exe
      ping -a -l www.duniasex.com 65500
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:544
  - - C:\Windows\SysWOW64\ping.exe
      ping -a -l www.rasasayang.com.my 65500
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:2996
  - - C:\Windows\SysWOW64\ping.exe
      ping -a -l www.duniasex.com 65500
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:3760
  - - C:\Windows\SysWOW64\ping.exe
      ping -a -l www.rasasayang.com.my 65500
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:4740
  - - C:\Windows\SysWOW64\ping.exe
      ping -a -l www.duniasex.com 65500
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:4436
- - C:\Windows\Fonts\Admin 2 - 5 - 2025\csrss.exe
    "C:\Windows\Fonts\Admin 2 - 5 - 2025\csrss.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4216
- - C:\Windows\SysWOW64\drivers\Kazekage.exe
    C:\Windows\system32\drivers\Kazekage.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:5056
- - C:\Windows\SysWOW64\drivers\system32.exe
    C:\Windows\system32\drivers\system32.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4768
- - C:\Windows\SysWOW64\ping.exe
    ping -a -l www.rasasayang.com.my 65500
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:1676
- - C:\Windows\SysWOW64\ping.exe
    ping -a -l www.duniasex.com 65500
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4972
- - C:\Windows\SysWOW64\ping.exe
    ping -a -l www.rasasayang.com.my 65500
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:3508
- - C:\Windows\SysWOW64\ping.exe
    ping -a -l www.duniasex.com 65500
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:3728
- - C:\Windows\SysWOW64\ping.exe
    ping -a -l www.rasasayang.com.my 65500
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:1020
- - C:\Windows\SysWOW64\ping.exe
    ping -a -l www.duniasex.com 65500
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:132
- C:\Windows\Fonts\Admin 2 - 5 - 2025\Gaara.exe
  "C:\Windows\Fonts\Admin 2 - 5 - 2025\Gaara.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5064
- C:\Windows\Fonts\Admin 2 - 5 - 2025\csrss.exe
  "C:\Windows\Fonts\Admin 2 - 5 - 2025\csrss.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3936
- C:\Windows\SysWOW64\drivers\Kazekage.exe
  C:\Windows\system32\drivers\Kazekage.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:544
- C:\Windows\SysWOW64\drivers\system32.exe
  C:\Windows\system32\drivers\system32.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5000
- C:\Windows\SysWOW64\ping.exe
  ping -a -l www.rasasayang.com.my 65500
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:4288
- C:\Windows\SysWOW64\ping.exe
  ping -a -l www.duniasex.com 65500
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:956
- C:\Windows\SysWOW64\ping.exe
  ping -a -l www.rasasayang.com.my 65500
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:4100
- C:\Windows\SysWOW64\ping.exe
  ping -a -l www.duniasex.com 65500
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:492
- C:\Windows\SysWOW64\ping.exe
  ping -a -l www.rasasayang.com.my 65500
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:3396
- C:\Windows\SysWOW64\ping.exe
  ping -a -l www.duniasex.com 65500
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:4664

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:5048

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:248

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:3196

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:648

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:3584

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:3712

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:4308

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:2524

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:4344

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:3812

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:4192

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:3516

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:2748

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:4444

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:1524

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:3492

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:2596

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:488

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:2276

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:2360

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:1676

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:3860

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:2624

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:1088

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:2948

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:4040

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:4452

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:4460

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:1412

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:1680

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:5052

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:2884

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:4740

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:5000

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:4572

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:3092

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:2356

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:1032

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:5048

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:1348

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:3908

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:2224

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:4320

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:4840

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:4428

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:3448

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:2780

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:4392

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:3568

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:464

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:2020

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:1496

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:344

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:2748

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:2808

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:2188

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:1924

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:2348

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:3184

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:1468

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:1748

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:1300

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:4436

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:3808

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:2508

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:4668

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:3948

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:1816

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:3544

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:3068

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:2512

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:5000

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:3520

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:4580

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:928

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:4908

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:4932

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:820

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:1080

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:2092

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:4448

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:3480

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:3396

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:1208

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:3764

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:2824

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:4444

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:2772

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:2364

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:4764

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:4368

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:2424

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:540

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:3388

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:1124

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:3776

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:4920

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:4220

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:2896

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:1616

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:3728

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:4852

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:3928

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:3948

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:3092

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:1200

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:2512

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:3968

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:484

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:2656

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:428

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:2220

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:3584

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:4932

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:404

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:2860

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:2780

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:3684

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:2820

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:1192

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:132

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:3956

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:3764

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:2772

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:1852

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:660

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:1276

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:2424

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:4916

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:1372

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:924

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:1684

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:2684

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:2012

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:4460

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:4760

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:4568

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:1680

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:3512

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:3760

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:3944

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:1756

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:3668

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:3432

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:1728

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:1612

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:3524

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:2912

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:5044

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:3504

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:1096

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:4448

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:4480

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:1608

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:4980

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:2124

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:2248

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:3808

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:2916

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:1616

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:1756

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:752

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:124

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:3588

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:2392

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:1356

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:2220

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:3712

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:1416

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:3584

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:2596

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:4288

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:2264

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:4316

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:4984

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:4620

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:2564

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:4768

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:4860

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:1412

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:1520

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:2656

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:2308

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:3520

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:4464

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:3480

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:4540

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:1660

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:1068

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:1856

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:2976

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:1864

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:1444

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:1232

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:2332

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:1592

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:2664

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:3672

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:1936

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:1976

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:2104

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:2276

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:1676

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:5060

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:4608

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:3760

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:2084

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:2564

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:3432

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:4792

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:1384

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:3960

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:2980

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:2220

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:232

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:4780

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:3684

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:2772

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:4512

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:3460

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:344

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:3584

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:4468

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:3860

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:1088

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:4368

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:2264

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:400

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:2392

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:1916

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:3412

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:1852

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:1212

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:2248

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:2044

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:2952

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:2404

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:5080

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:3012

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:540

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:2996

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:4140

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:4432

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:1200

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:4908

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:3944

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:3404

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:4356

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:4932

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:4840

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:1192

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:2824

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:2820

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:2596

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:2772

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:1660

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:4480

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:1372

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:3000

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:1560

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:3296

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:4568

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:408

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:5072

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:4740

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:544

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:1684

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:2660

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:2476

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:688

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:4852

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:2744

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:3016

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:2916

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:3204

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:2684

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:2804

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:4856

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:3908

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:3520

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:4976

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:1520

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:908

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:3896

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:3304

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:3400

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:3448

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:1328

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:1388

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:3860

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:4660

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:1216

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:2964

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:4636

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:3752

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:3136

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:3444

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:664

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:2188

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:4640

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:4644

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:1300

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:1548

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:4436

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:776

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:2476

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:1824

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:4512

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:1764

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:1668

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:2012

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:2880

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:4356

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:2800

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:3520

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:2912

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:4976

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:1348

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:1276

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:1504

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:1524

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:3316

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:4468

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:932

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:2592

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:3084

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:1088

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:4444

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:1560

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:2332

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:3140

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:544

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:3628

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:2264

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:2780

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:1916

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:2072

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:1540

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:4752

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:1852

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:2512

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:4512

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:3884

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:776

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:3624

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:2736

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:1728

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:4676

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:4208

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:3520

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:2480

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:4220

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:3380

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:3316

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:908

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:3548

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:4776

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:1628

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:2852

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:1372

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:2760

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:72

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:4388

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:420

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:3672

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:4748

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:1976

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:2016

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:4580

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:3808

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:1824

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:2804

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:2100

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:1716

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:1464

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:1504

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:2124

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:1524

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:3956

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:2992

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:3628

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:3928

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:2780

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:3296

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:1332

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:1428

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:1572

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:4324

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:4852

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:888

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:4928

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:4760

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:928

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:2368

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:3016

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:2128

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:2976

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:1464

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:892

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:3020

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:5000

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:3000

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:2812

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:3212

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:4320

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:2056

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:1660

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:4660

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:1976

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:2820

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:3576

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:2780

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:2208

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:4056

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:2896

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:4780

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:4732

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:1032

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:4372

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:2648

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:5080

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:3544

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:4680

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:3388

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:4616

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:540

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:896

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:4960

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:4984

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:2652

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:1416

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:2092

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:3516

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:3304

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:2032

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:5004

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:2424

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:3460

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:1460

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:3784

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:4604

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:1944

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:3368

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:348

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:3796

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:1388

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:3536

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:4040

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:4060

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:4580

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:3136

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:2072

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:776

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:5052

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:4044

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:596

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:4456

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:1252

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:2388

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:4912

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:4680

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:4676

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:1396

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:4544

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:5068

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:244

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:1496

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:3420

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:2220

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:3712

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:3200

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:460

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:1464

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:5004

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:2716

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:2880

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:3568

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:2232

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:3224

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:2248

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:2928

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:4568

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:3368

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:2344

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:2780

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:72

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:4752

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:3208

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:2276

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:3296

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:4964

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:4648

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:1612

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:776

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:1572

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:3088

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:2648

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:1372

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:3544

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:1200

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:4840

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:3016

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:1396

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:2728

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:4572

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:1020

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:896

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:244

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:1068

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:2800

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:2656

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:820

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:3120

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:4620

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:4916

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:1464

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:3328

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:1448

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:3428

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:4640

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:5092

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:3528

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:4388

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:4660

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:5072

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:2660

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:1168

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:4060

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:4480

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:1824

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:3672

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:1132

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:888

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:2720

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:2884

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:2736

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:404

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:4232

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:4680

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:1520

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:4316

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:1416

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:1088

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:2808

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:3940

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:3972

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:4600

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:4884

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:4356

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:776

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:1300

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:3352

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:3156

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:1816

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:3720

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:796

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:2400

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:1608

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:3232

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:3536

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:4516

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:3628

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:1940

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:1852

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:5072

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:3624

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:2952

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:4776

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:5112

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:4676

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:2044

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:3968

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:1904

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:2804

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:5044

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:2896

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:3464

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:2992

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:3204

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:2880

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:4108

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:408

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:72

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:1748

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:3628

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:4228

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:4792

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:2576

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:1764

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:1032

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:1924

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:3532

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:5060

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:2468

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:4976

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:4840

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:4316

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:2368

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:2824

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:4756

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:4604

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:832

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:3520

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:1628

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:3232

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:3208

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:4668

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:1332

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:568

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:1612

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:2684

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:3092

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:4636

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:888

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:1356

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:2480

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:4468

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:4464

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:2044

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:540

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:2896

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:4992

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:2616

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:4544

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:1124

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:3644

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:1916

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:1960

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:1692

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:2800

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:2232

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:4600

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:3460

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:832

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:3720

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:1096

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:4372

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:3208

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:1852

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:4060

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:2996

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:1416

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:3940

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:2496

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:3324

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:3088

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:4472

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:4812

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:4732

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:1764

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:4556

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:4192

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:3848

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:3060

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:2084

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:4456

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:820

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:3432

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:3084

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:4992

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:3364

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:4612

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:664

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:4736

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:2656

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:3224

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:3212

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:1364

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:688

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:4568

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:1344

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:2852

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:1872

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:3436

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:1168

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:2748

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:4580

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:2820

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:4920

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:2900

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:1448

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:2800

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:2720

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:3936

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:1088

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:4572

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:4464

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:4544

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:4840

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:1220

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:4144

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:4204

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:3516

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:3584

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:5116

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:820

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:3748

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:2424

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:1692

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:4736

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:420

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:3460

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:3128

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:2992

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:4372

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:1072

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:4392

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:2968

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:684

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:2596

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:1020

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:4304

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\smss.exe
1⤵
PID:3684

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Fonts\Admin 2 - 5 - 2025\Gaara.exe
1⤵
PID:3880

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c 2-5-2025.exe
1⤵
PID:2224

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c drivers\csrss.exe
1⤵
PID:3628

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

Readme.txt

Path C:\Admin Games\Readme.txt
Size 736B
SHA256 5db2e0915b5464d32e83484f8ae5e3c73d2c78f238fde5f58f9b40dbb5322de8
MD5 bb5d6abdf8d0948ac6895ce7fdfbc151
SHA1 9266b7a247a4685892197194d2b9b86c8f6dddbd
SHA512 878444760e8df878d65bb62b4798177e168eb099def58ad3634f4348e96705c83f74324f9fa358f0eff389991976698a233ca53e9b72034ae11c86d42322a76c
MD5 SHA1 SHA512

Submit Download

Autorun.inf

Path C:\Autorun.inf
Size 196B
SHA256 be114a2dbcc08540b314b01882aa836a772a883322a77b67aab31233e26dc184
MD5 1564dfe69ffed40950e5cb644e0894d1
SHA1 201b6f7a01cc49bb698bea6d4945a082ed454ce4
SHA512 72df187e39674b657974392cfa268e71ef86dc101ebd2303896381ca56d3c05aa9db3f0ab7d0e428d7436e0108c8f19e94c2013814d30b0b95a23a6b9e341097
MD5 SHA1 SHA512

Submit Download

Gaara.exe

Path C:\Windows\Fonts\Admin 2 - 5 - 2025\Gaara.exe
Size 8.3MB
SHA256 fc97b0fb8ac40e3cedf7ccc3ce3e1be0767d523a599961ca5d5cbde4015dfbef
MD5 b48cab1563fcd0c9b2c8810d13e8439b
SHA1 8615357db9dc51ca524910a8b6a35412b6ffcae5
SHA512 550241c8e6c89e49335964b38979a23503c8e9c6ce948bfc55c91be8c510812d8d45586a8a1da6cbdceb1372de6c88fb1c95f34aa587ce9a96bb0cc4025457e2
SSDEEP 49152:HGyqWyWy0GyqWyWyMRPC1eHc785diLvQ8b1gtj:HGyqWyWy0GyqWyWyMRPC1eHL5dGYSW
MD5 SHA1 SHA512 SSDEEP

Submit Download

csrss.exe

Path C:\Windows\Fonts\Admin 2 - 5 - 2025\csrss.exe
Size 8.3MB
SHA256 4a0a1ecc1e6ee951eda7f8b8944f551558384e7e6cf84b7e1348126271c572fe
MD5 252daf427ff74462bacd78a31277eb08
SHA1 0eb53676e022d38ea20f2f2290f1781ea7edd527
SHA512 4a49e17b195d74f301cc336922790032bda92dd783f38d1c4f3368d7552dfe520899c6354388496b3fc71e9157fa5d1fd466ce1948ecbf8f521c7a500ba0268b
SSDEEP 49152:9GyqWyWy0GyqWyWyMRPC1eHc785diLvQ8b1gtj:9GyqWyWy0GyqWyWyMRPC1eHL5dGYSW
MD5 SHA1 SHA512 SSDEEP

Submit Download

csrss.exe

Path C:\Windows\Fonts\Admin 2 - 5 - 2025\csrss.exe
Size 8.3MB
SHA256 348a3ad6778c00c046fdab243e0acf6e17b3522887860b3e2ee49ae82e1ce434
MD5 e33b187b66ce19fb0b583c35960325a7
SHA1 780b99861fa6b80258e36feb768e6ed077f449f8
SHA512 94a04dfd2010513412da956fe4dafa6377e8a49f763b2567d3a66d56a7ac445c0eb46998745017549db02dc566b33bb8b051ac92edd2ec0982e71c7b75459005
SSDEEP 49152:7GyqWyWy0GyqWyWyMRPC1eHc785diLvQ8b1gtj:7GyqWyWy0GyqWyWyMRPC1eHL5dGYSW
MD5 SHA1 SHA512 SSDEEP

Submit Download

smss.exe

Path C:\Windows\Fonts\Admin 2 - 5 - 2025\smss.exe
Size 8.3MB
SHA256 557765ff0b508fac5507506771f94745bac06472dcdb798c9369176ce49d326d
MD5 d9d5d17743916b6be1edb7b9ea34b8c7
SHA1 f73bb46d391ef834f11ae0e9f65645ccf48bb366
SHA512 3d981f5bbbe93892a75888b851682bd2abd75c46d1bead5463f49bb1ad8580b5efd6f82fbd3976666058b0b012c45843ab8c064d01b96b575e439f0b3c3d694a
SSDEEP 49152:YGyqWyWy0GyqWyWyMRPC1eHc785diLvQ8b1gtj:YGyqWyWy0GyqWyWyMRPC1eHL5dGYSW
MD5 SHA1 SHA512 SSDEEP

Submit Download

The Kazekage.jpg

Path C:\Windows\Fonts\The Kazekage.jpg
Size 1.4MB
SHA256 9824b98dab6af65a9e84c2ea40e9df948f9766ce2096e81feecad7db8dd6080a
MD5 d6b05020d4a0ec2a3a8b687099e335df
SHA1 df239d830ebcd1cde5c68c46a7b76dad49d415f4
SHA512 78fd360faa4d34f5732056d6e9ad7b9930964441c69cf24535845d397de92179553b9377a25649c01eb5ac7d547c29cc964e69ede7f2af9fc677508a99251fff
SSDEEP 3072:skMBALakDeiwKcfFJwwGgl0azGFcjooCmsvKgEpzGCUKVcqJo:skbmYwKc9JT0HFMpzG5KOF
MD5 SHA1 SHA512 SSDEEP

Submit Download

2-5-2025.exe

Path C:\Windows\SysWOW64\2-5-2025.exe
Size 3.6MB
SHA256 8363812e4f0bda961c509331aa96d75bab602e5f7f5bf553fabdf5c416bf0779
MD5 c3d84b3d31131194bcc83e07581fac6e
SHA1 d01b8efc3763843340c18f062f3f49b9e56b3fe5
SHA512 6bdad08c4262d676f05edaa535d58eca5a7835f37d12e33befbff8410d87c25a638319c68527dbd2b23ba705424e79851c740fa08ef18482eaf27a3e5977f992
SSDEEP 24576:lVG8gVG8UVG88VG8wVG8cVG8QVG8kVG8OVG8gVG8UVG88VG8wVG8cVG8QVG8kVGL:lGyqWyWy0GyqWyWyM
MD5 SHA1 SHA512 SSDEEP

Submit Download

2-5-2025.exe

Path C:\Windows\SysWOW64\2-5-2025.exe
Size 7.8MB
SHA256 1d75854dbe0ed89bdf2bba8fea1b6d8a69cdde2d57d1df21848a7672a8c0e332
MD5 2e5f14fd8a7c685af01d308543cb523f
SHA1 a423b6f2f159331722c0b1957af2f42e7ee99ee1
SHA512 e2ad22e8309c1d8fb35f1cca68ba6056a3d4ff71402c7edfbddc6b22602ac6efba38e13a50aa5bfa600074dd2716398f822ccd68d10db705f62475ecf8a3db4d
SSDEEP 49152:YGyqWyWy0GyqWyWyMRPC1eHc785diLvQZ:YGyqWyWy0GyqWyWyMRPC1eHL5dGYZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

2-5-2025.exe

Path C:\Windows\SysWOW64\2-5-2025.exe
Size 7.0MB
SHA256 57331c421f405fa6ae86f0923402fbb47325ea4e33800192f3561e602772dc3a
MD5 9f9a4a0543434a98c156ccf39975ea4b
SHA1 af14e02eba5bd62c7789b53e6430762ed3c6e82c
SHA512 74b41cfaa23c0dc4bcc84a55b05857105ee7093d7e1155ff1c689d7d6fb4482c721341473ae92eea2e9261f59fb49f7eeec57e6969e28dbd70c70671f844f3ce
SSDEEP 24576:HVG8gVG8UVG88VG8wVG8cVG8QVG8kVG8OVG8gVG8UVG88VG8wVG8cVG8QVG8kVGj:HGyqWyWy0GyqWyWyMRPC1eHc785dL
MD5 SHA1 SHA512 SSDEEP

Submit Download

2-5-2025.exe

Path C:\Windows\SysWOW64\2-5-2025.exe
Size 6.9MB
SHA256 dc8926fce7377a4101025adf71e61b5b317a9c62ee366037f7d5f9d79c99fbcc
MD5 9de4207a840e07b192f214aadec76fb3
SHA1 c46addefbea25c839800a008237fc8946627864f
SHA512 1f12d3fda9d3303cca4e65b1b8f6630b4259f129480f8626ce084b69dffc77d65c3dffc98262e86559ce95431ca69a126c55a019539a3dbb83a400fb1c01ee44
SSDEEP 24576:HVG8gVG8UVG88VG8wVG8cVG8QVG8kVG8OVG8gVG8UVG88VG8wVG8cVG8QVG8kVG7:HGyqWyWy0GyqWyWyMRPC1eHc7C
MD5 SHA1 SHA512 SSDEEP

Submit Download

Desktop.ini

Path C:\Windows\SysWOW64\Desktop.ini
Size 65B
SHA256 ba8159d865d106e7b4d0043007a63d1541e1de455dc8d7ff0edd3013bd425c62
MD5 64acfa7e03b01f48294cf30d201a0026
SHA1 10facd995b38a095f30b4a800fa454c0bcbf8438
SHA512 65a9b2e639de74a2a7faa83463a03f5f5b526495e3c793ec1e144c422ed0b842dd304cd5ff4f8aec3d76d826507030c5916f70a231429cea636ec2d8ab43931a
MD5 SHA1 SHA512

Submit Download

Kazekage.exe

Path C:\Windows\SysWOW64\drivers\Kazekage.exe
Size 8.3MB
SHA256 d06353a0cfa74e569a8848d249802a111accc1e3ac7e5ebbddc5cf4ee8c1c292
MD5 7c53aa241977706d4c97e4d46a314fa1
SHA1 53745105b57ce26a7044705894363c73d9c5129f
SHA512 b4c51341382264358395f40e0331b4cda5670cb89b9c34b1d0e085961702667bda9cabd4f841ac146a33c5097ef1aa5e0d99770bee5af162881c6cbc89c0488d
SSDEEP 49152:lGyqWyWy0GyqWyWyMRPC1eHc785diLvQ8b1gtj:lGyqWyWy0GyqWyWyMRPC1eHL5dGYSW
MD5 SHA1 SHA512 SSDEEP

Submit Download

Kazekage.exe

Path C:\Windows\SysWOW64\drivers\Kazekage.exe
Size 4.6MB
SHA256 1116d260aaef33d8113fae0eefcd57bbed3962a0b501fcb4714fa9d6211d127e
MD5 7324e3e0daa1faf7509ca1667190bf80
SHA1 0f685412fd285a94968a6b8d7f077280370250c8
SHA512 8c23410d76a6f4ec29e1a669c7bbee5a81c343172b35c688a7349f5305cb725d92b98ad0a8d3727fddee689ac75d696080d4d51c65119998d774ebe4d053f05a
SSDEEP 24576:HVG8gVG8UVG88VG8wVG8cVG8QVG8kVG8OVG8gVG8UVG88VG8wVG8cVG8QVG8kVGL:HGyqWyWy0GyqWyWyM
MD5 SHA1 SHA512 SSDEEP

Submit Download

system32.exe

Path C:\Windows\SysWOW64\drivers\system32.exe
Size 8.3MB
SHA256 02b835ea0e8db2f4a07a899910c2fbd7e57caa76c4a5ac0ac9c6992e2a564d14
MD5 7b841592cf313c498c801764bf11854a
SHA1 74bcd3478cbc9e890a4e392617b3d82d485d0dd1
SHA512 1fdf29ffaa3b9a075453b0293855970ed1b960c44799fe1a6944293397fd2fb394c012cced8a7950f4c4bba6187b1d01b25cffdce726e26f8e687fc1159724a9
SSDEEP 49152:zGyqWyWy0GyqWyWyMRPC1eHc785diLvQ8b1gtj:zGyqWyWy0GyqWyWyMRPC1eHL5dGYSW
MD5 SHA1 SHA512 SSDEEP

Submit Download

msvbvm60.dll

Path C:\Windows\System\msvbvm60.dll
Size 1.4MB
SHA256 898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2
MD5 25f62c02619174b35851b0e0455b3d94
SHA1 4e8ee85157f1769f6e3f61c0acbe59072209da71
SHA512 f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a
SSDEEP 24576:/NqrWz23mmOittiMQVZb2NOTGTZg2REA7qc+vM597KXNWU8fSV2z3PNGvCQSIjuT:/NQimtzbQVB2PpEVa2XNWUISV20AIq
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/544-297-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/544-302-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/972-112-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/1000-152-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/1524-166-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/1524-170-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/2348-259-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/2360-208-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/2736-270-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/2796-274-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/2988-277-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/2988-222-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/2988-582-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/2988-310-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/3020-210-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/3148-307-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/3148-207-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/3148-313-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/3148-456-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/3148-79-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/3356-305-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/3356-372-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/3356-311-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/3356-0-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/3356-165-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/3452-241-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/3452-498-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/3452-123-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/3452-308-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/3504-158-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/3504-164-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/3936-296-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/4216-279-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/4220-263-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/4356-70-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/4356-74-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/4652-306-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/4652-173-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/4652-584-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/4652-32-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/4732-116-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/4732-120-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/4768-288-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/4768-282-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/4772-175-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/4772-309-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/4772-255-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/4772-587-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/4956-247-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/4980-219-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/4980-215-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/5000-301-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/5000-304-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/5056-284-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/5060-254-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/5064-292-0x0000000000400000-0x000000000042A000-memory.dmp

Download