valleyrat_s2 | 22b35793ae1eb22f99564eb5c41b8f77309c29c63e723e746f5e495700576199

Analysis

max time kernel
150s
max time network
155s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 16:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_238dbfd03cb04d850fbcfdfd6d707c20_amadey_elex_luca-stealer_njrat_play.exe
Size 11.3MB
Sample260804-tyfazsal3s
SHA256 22b35793ae1eb22f99564eb5c41b8f77309c29c63e723e746f5e495700576199
MD5 238dbfd03cb04d850fbcfdfd6d707c20
SHA1 e75aef8cf258b7a095896c992e538e36a04f84bb
SHA512 af085dacd87b2a97d6124119b6a7eaeb1028945f96669ca61be5bc28facd280f3d4877f23f70556e2de5e119d514d998903cf3024a38c2969ade60c6234c3977
SSDEEP 98304:z9ihzzLZpooNT6c/iGChGs3pbG3jdsg4gOR/1XhDkF3O3sKCuDjGe54Fi:5s/unKB+xRNxe3O3NW8Si
TLSH
T167C6CF026E0717A8DC9EB6FC702C052500E9AC5F8FA849EA1FE7CD58D72E2A55061F5F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor defense_evasion discovery evasion valleyrat_s2 persistence privilege_escalation trojan

Malware Config

Extracted

Family

valleyrat_s2

Version

38.162.113.217:3322
103.119.15.173:3322

Attributes

campaign_date
2025.12. 9

Signatures

Family: ValleyRat
ValleyRat stage2 is a backdoor written in C++.
backdoor valleyrat_s2

Detects ValleyRAT payload 6 IoCs

resource	yara_rule
behavioral2/memory/2036-28-0x0000000001300000-0x00000000013EF000-memory.dmp	family_valleyrat_stage_2_v2
behavioral2/memory/2036-29-0x0000000001300000-0x00000000013EF000-memory.dmp	family_valleyrat_stage_2_v2
behavioral2/memory/5560-195-0x0000000000400000-0x00000000004EF000-memory.dmp	family_valleyrat_stage_2_v2
behavioral2/memory/5560-197-0x0000000000400000-0x00000000004EF000-memory.dmp	family_valleyrat_stage_2_v2
behavioral2/memory/5560-207-0x0000000002EA0000-0x0000000002EE6000-memory.dmp	family_valleyrat_stage_2_v2
behavioral2/memory/5560-203-0x0000000010000000-0x0000000010046000-memory.dmp	family_valleyrat_stage_2_v2

Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 3 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	DKECPUmHw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	DKECPUmHw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "49"	2026-08-04_238dbfd03cb04d850fbcfdfd6d707c20_amadey_elex_luca-stealer_njrat_play.exe

UAC bypass 3 TTPs 3 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	DKECPUmHw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	DKECPUmHw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "48"	2026-08-04_238dbfd03cb04d850fbcfdfd6d707c20_amadey_elex_luca-stealer_njrat_play.exe

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\gMreOhVB.lnk	2026-08-04_238dbfd03cb04d850fbcfdfd6d707c20_amadey_elex_luca-stealer_njrat_play.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FaCveHBxNPxKqdQu.XhMEwvsC	jzr.exe

Executes dropped EXE 10 IoCs

pid	Process
5040	Rar.exe
3720	Rar.exe
5916	DKECPUmHw.exe
396	jzr.exe
4724	jzr.exe
3600	jzr.exe
1256	DKECPUmHw.exe
4552	jzr.exe
6100	jzr.exe
4884	jzr.exe

Loads dropped DLL 2 IoCs

pid	Process
5916	DKECPUmHw.exe
1256	DKECPUmHw.exe

Checks whether UAC is enabled 1 TTPs 3 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	DKECPUmHw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	DKECPUmHw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "48"	2026-08-04_238dbfd03cb04d850fbcfdfd6d707c20_amadey_elex_luca-stealer_njrat_play.exe

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	Taskmgr.exe
File opened (read-only)	\??\H:	Taskmgr.exe
File opened (read-only)	\??\I:	Taskmgr.exe
File opened (read-only)	\??\R:	Taskmgr.exe
File opened (read-only)	\??\U:	Taskmgr.exe
File opened (read-only)	\??\V:	Taskmgr.exe
File opened (read-only)	\??\Y:	Taskmgr.exe
File opened (read-only)	\??\K:	Taskmgr.exe
File opened (read-only)	\??\L:	Taskmgr.exe
File opened (read-only)	\??\X:	Taskmgr.exe
File opened (read-only)	\??\Z:	Taskmgr.exe
File opened (read-only)	\??\B:	Taskmgr.exe
File opened (read-only)	\??\N:	Taskmgr.exe
File opened (read-only)	\??\O:	Taskmgr.exe
File opened (read-only)	\??\Q:	Taskmgr.exe
File opened (read-only)	\??\W:	Taskmgr.exe
File opened (read-only)	\??\G:	Taskmgr.exe
File opened (read-only)	\??\J:	Taskmgr.exe
File opened (read-only)	\??\M:	Taskmgr.exe
File opened (read-only)	\??\P:	Taskmgr.exe
File opened (read-only)	\??\S:	Taskmgr.exe
File opened (read-only)	\??\T:	Taskmgr.exe

Suspicious use of SetThreadContext 64 IoCs

description	pid	Process	procid_target
PID 5916 set thread context of 2036	5916	DKECPUmHw.exe	95
PID 5916 set thread context of 1876	5916	DKECPUmHw.exe	96
PID 5916 set thread context of 3380	5916	DKECPUmHw.exe	97
PID 5916 set thread context of 396	5916	DKECPUmHw.exe	98
PID 5916 set thread context of 4724	5916	DKECPUmHw.exe	99
PID 5916 set thread context of 3600	5916	DKECPUmHw.exe	100
PID 396 set thread context of 1968	396	jzr.exe	102
PID 396 set thread context of 4404	396	jzr.exe	103
PID 396 set thread context of 4972	396	jzr.exe	104
PID 396 set thread context of 2824	396	jzr.exe	105
PID 396 set thread context of 464	396	jzr.exe	106
PID 396 set thread context of 1580	396	jzr.exe	107
PID 396 set thread context of 4744	396	jzr.exe	108
PID 396 set thread context of 996	396	jzr.exe	110
PID 1256 set thread context of 5948	1256	DKECPUmHw.exe	111
PID 1256 set thread context of 2932	1256	DKECPUmHw.exe	112
PID 1256 set thread context of 4560	1256	DKECPUmHw.exe	113
PID 1256 set thread context of 4552	1256	DKECPUmHw.exe	114
PID 1256 set thread context of 6100	1256	DKECPUmHw.exe	115
PID 1256 set thread context of 4884	1256	DKECPUmHw.exe	116
PID 396 set thread context of 664	396	jzr.exe	117
PID 396 set thread context of 2964	396	jzr.exe	118
PID 396 set thread context of 5204	396	jzr.exe	119
PID 396 set thread context of 4200	396	jzr.exe	120
PID 396 set thread context of 3732	396	jzr.exe	121
PID 396 set thread context of 4284	396	jzr.exe	122
PID 396 set thread context of 2928	396	jzr.exe	123
PID 396 set thread context of 2404	396	jzr.exe	124
PID 396 set thread context of 5704	396	jzr.exe	125
PID 1256 set thread context of 1184	1256	DKECPUmHw.exe	126
PID 1256 set thread context of 5560	1256	DKECPUmHw.exe	127
PID 1256 set thread context of 4748	1256	DKECPUmHw.exe	128
PID 396 set thread context of 2144	396	jzr.exe	129
PID 396 set thread context of 3224	396	jzr.exe	130
PID 396 set thread context of 5840	396	jzr.exe	131
PID 396 set thread context of 3312	396	jzr.exe	132
PID 396 set thread context of 2356	396	jzr.exe	133
PID 396 set thread context of 5700	396	jzr.exe	134
PID 396 set thread context of 3132	396	jzr.exe	135
PID 396 set thread context of 3148	396	jzr.exe	137
PID 396 set thread context of 5116	396	jzr.exe	138
PID 396 set thread context of 5208	396	jzr.exe	139
PID 396 set thread context of 3264	396	jzr.exe	140
PID 396 set thread context of 3424	396	jzr.exe	141
PID 396 set thread context of 4948	396	jzr.exe	142
PID 396 set thread context of 4220	396	jzr.exe	143
PID 396 set thread context of 2476	396	jzr.exe	144
PID 396 set thread context of 3888	396	jzr.exe	145
PID 396 set thread context of 5544	396	jzr.exe	146
PID 396 set thread context of 3320	396	jzr.exe	147
PID 396 set thread context of 2428	396	jzr.exe	148
PID 396 set thread context of 1776	396	jzr.exe	149
PID 396 set thread context of 2836	396	jzr.exe	150
PID 396 set thread context of 5724	396	jzr.exe	151
PID 396 set thread context of 5444	396	jzr.exe	152
PID 396 set thread context of 2436	396	jzr.exe	153
PID 396 set thread context of 5824	396	jzr.exe	154
PID 396 set thread context of 3292	396	jzr.exe	155
PID 396 set thread context of 5440	396	jzr.exe	156
PID 396 set thread context of 3056	396	jzr.exe	157
PID 396 set thread context of 4620	396	jzr.exe	158
PID 396 set thread context of 4444	396	jzr.exe	159
PID 396 set thread context of 5764	396	jzr.exe	161
PID 396 set thread context of 5652	396	jzr.exe	162

Drops file in Program Files directory 11 IoCs

description	ioc	Process
File created	C:\Program Files\DKECPUmH\1.rar	2026-08-04_238dbfd03cb04d850fbcfdfd6d707c20_amadey_elex_luca-stealer_njrat_play.exe
File created	C:\Program Files\DKECPUmH\jzr.exe	2026-08-04_238dbfd03cb04d850fbcfdfd6d707c20_amadey_elex_luca-stealer_njrat_play.exe
File created	C:\Program Files\DKECPUmH\libOpenglRender.dll	Rar.exe
File created	C:\Program Files\DKECPUmH\axccnz.exe	2026-08-04_238dbfd03cb04d850fbcfdfd6d707c20_amadey_elex_luca-stealer_njrat_play.exe
File created	C:\Program Files\DKECPUmH\shouhu.txt	2026-08-04_238dbfd03cb04d850fbcfdfd6d707c20_amadey_elex_luca-stealer_njrat_play.exe
File created	C:\Program Files\DKECPUmH\gMreOhVBNedca.exe	2026-08-04_238dbfd03cb04d850fbcfdfd6d707c20_amadey_elex_luca-stealer_njrat_play.exe
File created	C:\Program Files\DKECPUmH\MSVCR90.dll	Rar.exe
File opened for modification	C:\Program Files\DKECPUmH\MSVCR90.dll	Rar.exe
File opened for modification	C:\Program Files\DKECPUmH\libOpenglRender.dll	Rar.exe
File created	C:\Program Files\DKECPUmH\DKECPUmHw.exe	2026-08-04_238dbfd03cb04d850fbcfdfd6d707c20_amadey_elex_luca-stealer_njrat_play.exe
File created	C:\Program Files\DKECPUmH\asvv.txt	2026-08-04_238dbfd03cb04d850fbcfdfd6d707c20_amadey_elex_luca-stealer_njrat_play.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_238dbfd03cb04d850fbcfdfd6d707c20_amadey_elex_luca-stealer_njrat_play.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Rar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Rar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DKECPUmHw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jzr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jzr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jzr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DKECPUmHw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Taskmgr.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FaCveHBxN\Shell	jzr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FaCveHBxN\Shell\Open	jzr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FaCveHBxN\Shell\Open\Command\ = "C:\\PROGRA~1\\DKECPUmH\\DKECPUmHw.exe"	jzr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.XhMEwvsC	jzr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.XhMEwvsC\ = "FaCveHBxN"	jzr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FaCveHBxN\Shell\Open\Command	jzr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FaCveHBxN	jzr.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4084	2026-08-04_238dbfd03cb04d850fbcfdfd6d707c20_amadey_elex_luca-stealer_njrat_play.exe
4084	2026-08-04_238dbfd03cb04d850fbcfdfd6d707c20_amadey_elex_luca-stealer_njrat_play.exe
4084	2026-08-04_238dbfd03cb04d850fbcfdfd6d707c20_amadey_elex_luca-stealer_njrat_play.exe
4084	2026-08-04_238dbfd03cb04d850fbcfdfd6d707c20_amadey_elex_luca-stealer_njrat_play.exe
4084	2026-08-04_238dbfd03cb04d850fbcfdfd6d707c20_amadey_elex_luca-stealer_njrat_play.exe
4084	2026-08-04_238dbfd03cb04d850fbcfdfd6d707c20_amadey_elex_luca-stealer_njrat_play.exe
4084	2026-08-04_238dbfd03cb04d850fbcfdfd6d707c20_amadey_elex_luca-stealer_njrat_play.exe
4084	2026-08-04_238dbfd03cb04d850fbcfdfd6d707c20_amadey_elex_luca-stealer_njrat_play.exe
396	jzr.exe
396	jzr.exe
396	jzr.exe
396	jzr.exe
396	jzr.exe
396	jzr.exe
396	jzr.exe
396	jzr.exe
396	jzr.exe
396	jzr.exe
396	jzr.exe
396	jzr.exe
396	jzr.exe
396	jzr.exe
396	jzr.exe
396	jzr.exe
396	jzr.exe
396	jzr.exe
396	jzr.exe
396	jzr.exe
396	jzr.exe
396	jzr.exe
396	jzr.exe
396	jzr.exe
396	jzr.exe
396	jzr.exe
396	jzr.exe
396	jzr.exe
396	jzr.exe
396	jzr.exe
396	jzr.exe
396	jzr.exe
396	jzr.exe
396	jzr.exe
396	jzr.exe
396	jzr.exe
396	jzr.exe
396	jzr.exe
396	jzr.exe
396	jzr.exe
396	jzr.exe
396	jzr.exe
396	jzr.exe
396	jzr.exe
396	jzr.exe
396	jzr.exe
396	jzr.exe
396	jzr.exe
396	jzr.exe
396	jzr.exe
396	jzr.exe
396	jzr.exe
396	jzr.exe
396	jzr.exe
5916	DKECPUmHw.exe
5916	DKECPUmHw.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5560	Taskmgr.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
5916	DKECPUmHw.exe
396	jzr.exe
4724	jzr.exe
1256	DKECPUmHw.exe
4552	jzr.exe
5560	Taskmgr.exe
5560	Taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4084 wrote to memory of 5040	4084	2026-08-04_238dbfd03cb04d850fbcfdfd6d707c20_amadey_elex_luca-stealer_njrat_play.exe	89
PID 4084 wrote to memory of 3720	4084	2026-08-04_238dbfd03cb04d850fbcfdfd6d707c20_amadey_elex_luca-stealer_njrat_play.exe	91
PID 5916 wrote to memory of 2036	5916	DKECPUmHw.exe	95
PID 5916 wrote to memory of 2036	5916	DKECPUmHw.exe	95
PID 5916 wrote to memory of 2036	5916	DKECPUmHw.exe	95
PID 5916 wrote to memory of 2036	5916	DKECPUmHw.exe	95
PID 5916 wrote to memory of 2036	5916	DKECPUmHw.exe	95
PID 5916 wrote to memory of 2036	5916	DKECPUmHw.exe	95
PID 5916 wrote to memory of 1876	5916	DKECPUmHw.exe	96
PID 5916 wrote to memory of 1876	5916	DKECPUmHw.exe	96
PID 5916 wrote to memory of 1876	5916	DKECPUmHw.exe	96
PID 5916 wrote to memory of 1876	5916	DKECPUmHw.exe	96
PID 5916 wrote to memory of 1876	5916	DKECPUmHw.exe	96
PID 5916 wrote to memory of 1876	5916	DKECPUmHw.exe	96
PID 5916 wrote to memory of 3380	5916	DKECPUmHw.exe	97
PID 5916 wrote to memory of 3380	5916	DKECPUmHw.exe	97
PID 5916 wrote to memory of 3380	5916	DKECPUmHw.exe	97
PID 5916 wrote to memory of 3380	5916	DKECPUmHw.exe	97
PID 5916 wrote to memory of 3380	5916	DKECPUmHw.exe	97
PID 5916 wrote to memory of 3380	5916	DKECPUmHw.exe	97
PID 5916 wrote to memory of 396	5916	DKECPUmHw.exe	98
PID 5916 wrote to memory of 396	5916	DKECPUmHw.exe	98
PID 5916 wrote to memory of 396	5916	DKECPUmHw.exe	98
PID 5916 wrote to memory of 396	5916	DKECPUmHw.exe	98
PID 5916 wrote to memory of 396	5916	DKECPUmHw.exe	98
PID 5916 wrote to memory of 396	5916	DKECPUmHw.exe	98
PID 5916 wrote to memory of 4724	5916	DKECPUmHw.exe	99
PID 5916 wrote to memory of 4724	5916	DKECPUmHw.exe	99
PID 5916 wrote to memory of 4724	5916	DKECPUmHw.exe	99
PID 5916 wrote to memory of 4724	5916	DKECPUmHw.exe	99
PID 5916 wrote to memory of 4724	5916	DKECPUmHw.exe	99
PID 5916 wrote to memory of 4724	5916	DKECPUmHw.exe	99
PID 5916 wrote to memory of 3600	5916	DKECPUmHw.exe	100
PID 5916 wrote to memory of 3600	5916	DKECPUmHw.exe	100
PID 5916 wrote to memory of 3600	5916	DKECPUmHw.exe	100
PID 5916 wrote to memory of 3600	5916	DKECPUmHw.exe	100
PID 5916 wrote to memory of 3600	5916	DKECPUmHw.exe	100
PID 5916 wrote to memory of 3600	5916	DKECPUmHw.exe	100
PID 396 wrote to memory of 1968	396	jzr.exe	102
PID 396 wrote to memory of 1968	396	jzr.exe	102
PID 396 wrote to memory of 1968	396	jzr.exe	102
PID 396 wrote to memory of 1968	396	jzr.exe	102
PID 396 wrote to memory of 1968	396	jzr.exe	102
PID 396 wrote to memory of 1968	396	jzr.exe	102
PID 396 wrote to memory of 4404	396	jzr.exe	103
PID 396 wrote to memory of 4404	396	jzr.exe	103
PID 396 wrote to memory of 4404	396	jzr.exe	103
PID 396 wrote to memory of 4404	396	jzr.exe	103
PID 396 wrote to memory of 4404	396	jzr.exe	103
PID 396 wrote to memory of 4404	396	jzr.exe	103
PID 396 wrote to memory of 4972	396	jzr.exe	104
PID 396 wrote to memory of 4972	396	jzr.exe	104
PID 396 wrote to memory of 4972	396	jzr.exe	104
PID 396 wrote to memory of 4972	396	jzr.exe	104
PID 396 wrote to memory of 4972	396	jzr.exe	104
PID 396 wrote to memory of 4972	396	jzr.exe	104
PID 396 wrote to memory of 2824	396	jzr.exe	105
PID 396 wrote to memory of 2824	396	jzr.exe	105
PID 396 wrote to memory of 2824	396	jzr.exe	105
PID 396 wrote to memory of 2824	396	jzr.exe	105
PID 396 wrote to memory of 2824	396	jzr.exe	105
PID 396 wrote to memory of 2824	396	jzr.exe	105
PID 396 wrote to memory of 464	396	jzr.exe	106
PID 396 wrote to memory of 464	396	jzr.exe	106

System policy modification 1 TTPs 4 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "48"	2026-08-04_238dbfd03cb04d850fbcfdfd6d707c20_amadey_elex_luca-stealer_njrat_play.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	DKECPUmHw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	DKECPUmHw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	2026-08-04_238dbfd03cb04d850fbcfdfd6d707c20_amadey_elex_luca-stealer_njrat_play.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-04_238dbfd03cb04d850fbcfdfd6d707c20_amadey_elex_luca-stealer_njrat_play.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_238dbfd03cb04d850fbcfdfd6d707c20_amadey_elex_luca-stealer_njrat_play.exe"
1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- UAC bypass
- Creates a file in the Startup directory
- Checks whether UAC is enabled
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4084
- C:\Users\Admin\AppData\Roaming\Rar.exe
  C:\Users\Admin\AppData\Roaming\\Rar.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5040
- C:\Users\Admin\AppData\Roaming\Rar.exe
  "C:\Users\Admin\AppData\Roaming\\Rar.exe" x -p123 "C:\Program Files\DKECPUmH\1.rar" "C:\Program Files\DKECPUmH"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:3720
- C:\Program Files\DKECPUmH\DKECPUmHw.exe
  "C:\Program Files\DKECPUmH\DKECPUmHw.exe"
  2⤵
  - Modifies Windows Defender DisableAntiSpyware settings
  - UAC bypass
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks whether UAC is enabled
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - System policy modification
  PID:1256
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:5948
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:2932
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:4560
- - C:\Program Files\DKECPUmH\jzr.exe
    "C:\Program Files\DKECPUmH\jzr.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4552
- - C:\Program Files\DKECPUmH\jzr.exe
    "C:\Program Files\DKECPUmH\jzr.exe"
    3⤵
    - Executes dropped EXE
    PID:6100
- - C:\Program Files\DKECPUmH\jzr.exe
    "C:\Program Files\DKECPUmH\jzr.exe"
    3⤵
    - Executes dropped EXE
    PID:4884
- - C:\Windows\SysWOW64\Taskmgr.exe
    Taskmgr.exe
    3⤵
    PID:1184
- - C:\Windows\SysWOW64\Taskmgr.exe
    Taskmgr.exe
    3⤵
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:5560
- - C:\Windows\SysWOW64\Taskmgr.exe
    Taskmgr.exe
    3⤵
    PID:4748

C:\PROGRA~1\DKECPUmH\DKECPUmHw.exe
C:\PROGRA~1\DKECPUmH\DKECPU~1.EXE
1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- UAC bypass
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:5916
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe
  2⤵
  PID:2036
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe
  2⤵
  PID:1876
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe
  2⤵
  PID:3380
- C:\PROGRA~1\DKECPUmH\jzr.exe
  C:\PROGRA~1\DKECPUmH\jzr.exe
  2⤵
  - Creates a file in the Startup directory
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:396
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:1968
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:4404
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:4972
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:2824
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:464
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:1580
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:4744
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:996
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:664
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:2964
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:5204
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:4200
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:3732
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:4284
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:2928
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:2404
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:5704
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:2144
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:3224
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:5840
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:3312
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:2356
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:5700
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:3132
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:5980
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:3148
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:5116
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:5208
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:3264
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:3424
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:4948
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:4220
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:2476
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:3888
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:5544
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:3320
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:2428
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:1776
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:2836
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:5724
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:5444
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:2436
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:5824
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:3292
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:5440
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:3056
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:4620
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:4444
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:1488
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:5764
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:5652
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:4880
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:792
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:5044
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:4760
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:816
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:4992
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:1932
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:872
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:2620
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:1636
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:4556
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:5048
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:5348
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:1668
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:4412
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:1808
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:5068
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:2764
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:4704
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:1948
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:4884
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:4044
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:480
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:5748
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:2564
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:3192
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:3828
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:3664
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:2728
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:4956
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:5576
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:548
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:2672
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:5536
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:4300
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:3224
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:1936
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:4232
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:5780
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:4872
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:5900
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:5716
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:4960
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:1764
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:5368
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:5448
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:5088
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:2892
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:3176
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:2844
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:2392
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:3672
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:1440
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:1640
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:1776
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:5036
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:6012
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:4228
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:1572
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:5944
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:2776
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:2380
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:5744
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:4932
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:4788
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:4104
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:4584
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:3736
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:3760
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:240
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:4060
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:616
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:244
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:3080
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:5672
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:3436
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:2364
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:4556
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:5048
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:5348
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:1668
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:5660
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:2252
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:996
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:2324
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:2948
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:1604
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:4324
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:1272
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:4756
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:5252
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:6044
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:2528
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:2512
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:5624
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:5956
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:3512
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:5248
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:5984
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:2960
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:552
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:5576
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:548
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:5336
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:5268
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:4080
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:3472
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:2444
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:4132
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:2356
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:5900
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:3084
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:5524
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:2732
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:5452
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:3172
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:4544
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:6056
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:2640
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:1000
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:5264
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:3012
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:1640
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:2836
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:2944
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:5444
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:3112
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:852
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:3292
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:1076
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:3756
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:1748
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:5772
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:1880
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:5572
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:1560
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:3736
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:5392
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:4036
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:3628
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:1368
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:4612
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:1932
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:4752
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:2396
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:1204
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:4392
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:2180
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:4844
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:5344
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:3088
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:5364
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:3052
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:5728
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:1492
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:4560
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:5168
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:5600
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:5324
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:4044
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:2420
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:3352
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:3216
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:2912
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:4564
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:1752
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:2648
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:2728
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:1732
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:744
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:3632
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:1960
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:2076
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:5584
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:4300
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:2184
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:4792
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:2616
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:3312
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:5780
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:5700
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:1584
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:5116
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:1460
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:5368
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:5448
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:2508
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:5088
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:4692
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:428
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:4144
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:5720
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:1440
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:1660
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:1640
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:5076
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:4712
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:5092
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:2436
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:852
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:3292
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:4680
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:3196
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:3064
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:4580
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:3348
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:4584
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:3600
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:4636
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:4820
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:1556
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:244
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:3080
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:872
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:1344
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:1636
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:4556
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:5048
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:4844
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:5344
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:3088
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:5364
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:3052
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:2324
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:3824
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:1604
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:5868
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:1948
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:4088
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:5488
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:2756
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:3392
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:2564
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:928
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:5956
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:1168
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:4216
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:5704
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:2960
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:1464
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:4468
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:3280
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:4384
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:5268
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:5972
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:2060
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:4356
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:1824
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:4112
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:3652
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:4068
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:2208
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:1764
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:4812
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:3256
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:1980
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:4948
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:4544
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:4220
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:1984
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:5548
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:3468
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:5428
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:4032
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:1644
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:1844
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:3368
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:4176
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:936
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:1572
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:1820
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:908
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:5440
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:3056
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:5744
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:5596
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:5272
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:5572
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:5740
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:3380
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:5392
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:4760
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:816
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:4600
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:5244
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:3676
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:4752
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:6020
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:5988
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:1124
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:5516
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:2696
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:4064
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:1808
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:4784
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:4448
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:996
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:1416
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:3920
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:1412
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:4704
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:4280
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:5868
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:1948
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:2160
- C:\PROGRA~1\DKECPUmH\jzr.exe
  C:\PROGRA~1\DKECPUmH\jzr.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4724
- C:\PROGRA~1\DKECPUmH\jzr.exe
  C:\PROGRA~1\DKECPUmH\jzr.exe
  2⤵
  - Executes dropped EXE
  PID:3600

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

asvv.txt

Path C:\PROGRA~1\DKECPUmH\asvv.txt
Size 884KB
SHA256 aefc73a1906bf386b0b4f50e4db19f02f794535b2b3ceb936ff4fda0131bf4c5
MD5 8d4a2c2f9f3c80d841a32078540d6ff3
SHA1 05e809cb08756a00146ca54e02c2480dc95a3fed
SHA512 36dc32fd084f2809fefa69148a7724dee7c84eb4ff7e353d5372288041b32596906ad3abef1a0e762f7bade93013dcdd28e7a5e763c79d126f1b89e991e2ee14
SSDEEP 24576:pSEsAq5GeXkk2SVsuwGu1qrSF/d5Hywxgl:6d5GeXkIVx41CSddw
TLSH
T1A51501925D0317429D5EB1DD323CE2226BE49C5F5FEE10AA4FE3C628DFAD218195AC07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

shouhu.txt

Path C:\PROGRA~1\DKECPUmH\shouhu.txt
Size 340KB
SHA256 9c0396e4d7b57c90568e4bc7ea26702d03073b1ec0775cff60d73039645d83db
MD5 77fafdba0e6f03bb30de29f4b1a2b31e
SHA1 911d6e0cfe7bdaf6646ba7048633ca0c11d98f4b
SHA512 5e04b6b312ed1d0aa5735bf78456a7e5276adbcf9d48c429a4066367462fa51cdfb9fccc93b8d774e66af534bf82bd87a15d8c02cfeba2997c5e0d84f4fe08e4
SSDEEP 6144:pgs3hLqUeVgODZ3O7fu8W6YEP8UaAy01IHfdOHPZB:pIbVfDgjuy2016fdOhB
TLSH
T12974DF464DA707C69C1DFAED324C203969F06D8F0F506A5C8FEBC269C38D6195A5EC2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1.rar

Path C:\Program Files\DKECPUmH\1.rar
Size 1.4MB
SHA256 65f52fc9decb2747f7d49bc57ca464c663f62340218de8471a4f181a7d2c5cf4
MD5 ee3aacbae62467706711920012da06b8
SHA1 56d8f0724a2f0f1aa01d69559bf2e13304c172da
SHA512 ea53e0a4af85cb6f63657b11e47f129db30a17093da7b627803c00dce19b0ec34d54b2df2b138df00ab306469bf7f22711c0028de307278826628cb5d7f1b600
SSDEEP 24576:3ZubrkSxjpo+GQ2IUv/ZVsT2E538aMGBTEnTsfyjzJ4fp+vQr5n0l4g6:34nkSxVoC2IGHsaQ3pMGBIYqjd4fp+43
TLSH
T15C6533516A646321F7C5E37B25EBE628133660701A0C568E227F71E664BE390CBF274F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DKECPUmHw.exe

Path C:\Program Files\DKECPUmH\DKECPUmHw.exe
Size 23KB
SHA256 10b3e08f2a144809ed178e5b7e8382439ffaef8bf1e351cda606453e07ee5c1e
MD5 a3b2cf55c7370fb05e26a788ede52342
SHA1 ee699ba7eee607dc98638fd1bb6ff6be9852d60f
SHA512 51bff44116e1d5e7018e60023b882cf1c8f0198b7396b50d1ae5f00f5e93979b9131f897f4f593af27d9f298f56268fa98ec1d301ea49b2cf4e04a7e512342b7
SSDEEP 384:CwhRG4nEHv8dWS8nYPLQRIA9eMBnNIAQY1mYfTUujH3RKnhsq:FhRG4nQ28ouvEaq
TLSH
T191B24CC71E255013EFC6CDB0A2D6C26B9D79A391BFC514E7A5B680C22EC1BE1375A01E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jzr.exe

Path C:\Program Files\DKECPUmH\jzr.exe
Size 52KB
SHA256 f02eed05526a3a19db35629fdb8eda6a6f29a176f827ce589d25e5c72094ef16
MD5 3062dadb197fe1aa0eb47d646b639145
SHA1 7989f84c216b12c21403cfd771c6cdf2d5e4539d
SHA512 a4e12c48dadbf48ba837674044fb3e1d9f63d0711bdabf1067485d6cc10527fe2cb7afc476e574049d8c6bd4348be83a58e3c427b3e3959100ec1bca3ebef0e3
SSDEEP 768:MjQLNm+RgCiCh6RPlP2KQHhXqVyjADcVlcOD0DRbDRHE1PoK9zL:8+RgCiCh6RPB2KQBX5j9c+0DRdUP5zL
TLSH
T1CC337C46FF9D8051FDA215F42579B127293EAE680B0046C3ABA54BC659E07C4FE303BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Rar.exe

Path C:\Users\Admin\AppData\Roaming\Rar.exe
Size 752KB
SHA256 0a88d153334d6865273920593d947bb3b6f9af945f7d479865b1e9f3354042b5
MD5 9b08fd1d59cb47aa7bf456e6d388f6c2
SHA1 31923271d11a2f8d2aaf758e00fc2029a3614335
SHA512 0a35c61dda6b0d8d307a87a024bf7390690de83aee938f2b53e56768f466dd872237dc638fbab5a427c44221331236f1350b38292cb763fd5a65967317063457
SSDEEP 12288:Dg8iUgFN1QNos4sIEp06G0kv6cNp1w3DtN8CDv49pAcpbjFkhkuFhqU:1iUgFN1QNoHDEobNpPZAcpXFzujV
TLSH
T175F4BF107983C2B2D13101B1011EAF73A5BE9F540B7129DB93C81E7A69695D32E3AF6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/396-43-0x0000000000400000-0x0000000000465000-memory.dmp

Download

memory/396-45-0x0000000000400000-0x0000000000465000-memory.dmp

Download

memory/396-53-0x0000000000400000-0x0000000000465000-memory.dmp

Download

memory/396-42-0x0000000000400000-0x0000000000465000-memory.dmp

Download

memory/396-44-0x0000000000400000-0x0000000000465000-memory.dmp

Download

memory/2036-28-0x0000000001300000-0x00000000013EF000-memory.dmp

Download

memory/2036-26-0x0000000001300000-0x00000000013EF000-memory.dmp

Download

memory/2036-29-0x0000000001300000-0x00000000013EF000-memory.dmp

Download

memory/2036-27-0x0000000001300000-0x00000000013EF000-memory.dmp

Download

memory/5560-195-0x0000000000400000-0x00000000004EF000-memory.dmp

Download

memory/5560-197-0x0000000000400000-0x00000000004EF000-memory.dmp

Download

memory/5560-207-0x0000000002EA0000-0x0000000002EE6000-memory.dmp

Download

memory/5560-203-0x0000000010000000-0x0000000010046000-memory.dmp

Download