e35a86b76025f4ae26fefa0b5f4e9ebbcb829781c3cf42f134a0f4df20c34912

Analysis

max time kernel
150s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
06/10/2026, 15:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
Size 1.1MB
Sample261006-sdmc5azv8k
SHA256 e35a86b76025f4ae26fefa0b5f4e9ebbcb829781c3cf42f134a0f4df20c34912
MD5 249d459ffc75875988ca2ebf1587aead
SHA1 2f7c9edea440f4770a1796b0a95e047dd04b474f
SHA512 f5f648b9e52e7e62e7a057c2aa5652f1271e6216c78fdf2ade0cb6ced7cc7f1844c5830bde039d5eda0bc864b0e0cd35b394fc9bfc52d8b80da610937ff26743
SSDEEP 24576:yGEoUEoCPSNxRFzxGbp7acoouofC6Ivmj5WzD:eCCHzMa8W
TLSH
T1053523103FE1163FCE6CC77535FA7E0D5AE693A2684CC19A7DAC78C61B56B810423A6C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Uses the VBS compiler for execution 1 TTPs

Command and Scripting Interpreter
T1059

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3004 wrote to memory of 3812	3004	jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe	85
PID 3812 wrote to memory of 2008	3812	vbc.exe	87
PID 3004 wrote to memory of 3212	3004	jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe	89
PID 3212 wrote to memory of 5028	3212	jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe	90
PID 5028 wrote to memory of 2312	5028	vbc.exe	92
PID 3212 wrote to memory of 3532	3212	jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe	93
PID 3532 wrote to memory of 4892	3532	jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe	94
PID 4892 wrote to memory of 1532	4892	vbc.exe	96
PID 3532 wrote to memory of 2724	3532	jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe	97
PID 2724 wrote to memory of 4016	2724	jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe	99
PID 4016 wrote to memory of 976	4016	vbc.exe	102
PID 2724 wrote to memory of 464	2724	jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe	103
PID 464 wrote to memory of 560	464	jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe	105
PID 560 wrote to memory of 2880	560	vbc.exe	107
PID 464 wrote to memory of 2300	464	jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe	108
PID 2300 wrote to memory of 2424	2300	jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe	109
PID 2424 wrote to memory of 3384	2424	vbc.exe	111
PID 2300 wrote to memory of 4004	2300	jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe	112
PID 4004 wrote to memory of 2728	4004	jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe	113
PID 2728 wrote to memory of 4648	2728	vbc.exe	115
PID 4004 wrote to memory of 1916	4004	jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe	116
PID 1916 wrote to memory of 3796	1916	jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe	117
PID 3796 wrote to memory of 2372	3796	vbc.exe	121
PID 1916 wrote to memory of 4260	1916	jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe	122
PID 4260 wrote to memory of 2240	4260	jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe	123
PID 2240 wrote to memory of 2408	2240	vbc.exe	125
PID 4260 wrote to memory of 1432	4260	jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe	126
PID 1432 wrote to memory of 3616	1432	jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe	127
PID 3616 wrote to memory of 2580	3616	vbc.exe	130
PID 1432 wrote to memory of 4532	1432	jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe	132
PID 4532 wrote to memory of 4792	4532	jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe	133
PID 4792 wrote to memory of 976	4792	vbc.exe	135
PID 4532 wrote to memory of 3096	4532	jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe	136
PID 3096 wrote to memory of 3752	3096	jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe	137
PID 3752 wrote to memory of 4972	3752	vbc.exe	139
PID 3096 wrote to memory of 2824	3096	jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe	140
PID 2824 wrote to memory of 1408	2824	jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe	141
PID 1408 wrote to memory of 3320	1408	vbc.exe	143
PID 2824 wrote to memory of 4100	2824	jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe	144
PID 4100 wrote to memory of 3152	4100	jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe	145
PID 3152 wrote to memory of 1656	3152	vbc.exe	147
PID 4100 wrote to memory of 3896	4100	jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe	148
PID 3896 wrote to memory of 3756	3896	jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe	150
PID 3756 wrote to memory of 3668	3756	vbc.exe	152
PID 3896 wrote to memory of 4816	3896	jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe	153
PID 4816 wrote to memory of 3524	4816	jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe	154
PID 3524 wrote to memory of 2392	3524	vbc.exe	156
PID 4816 wrote to memory of 1548	4816	jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe	157
PID 1548 wrote to memory of 2008	1548	jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe	158
PID 2008 wrote to memory of 3772	2008	vbc.exe	160
PID 1548 wrote to memory of 2104	1548	jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe	161
PID 2104 wrote to memory of 3952	2104	jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe	162
PID 3952 wrote to memory of 1080	3952	vbc.exe	164
PID 2104 wrote to memory of 1712	2104	jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe	165
PID 1712 wrote to memory of 4656	1712	jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe	166
PID 4656 wrote to memory of 1404	4656	vbc.exe	168
PID 1712 wrote to memory of 4604	1712	jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe	169
PID 4604 wrote to memory of 4616	4604	jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe	170
PID 4616 wrote to memory of 3728	4616	vbc.exe	172
PID 4604 wrote to memory of 2744	4604	jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe	173
PID 2744 wrote to memory of 1044	2744	jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe	176
PID 1044 wrote to memory of 2256	1044	vbc.exe	178
PID 2744 wrote to memory of 1232	2744	jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe	179
PID 1232 wrote to memory of 4076	1232	jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe	181

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3004
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\u_mcfbrc.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3812
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6CDE.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcD1B0526D14E54D4CA2C37AB97F6FB98F.TMP"
    3⤵
    PID:2008
- C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
  C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3212
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\h-n7v8gp.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5028
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7182.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc67B0040F580D470AABE2F6B46A45CC4.TMP"
      4⤵
      PID:2312
- - C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
    C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3532
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\nzimlwei.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4892
    - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7635.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc72463EAC51B4401BADBBF7274C5664E9.TMP"
        5⤵
        
        PID:1532
  - - C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
      C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2724
    - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\dphetxcp.cmdline"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4016
      - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES84EA.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc57A20DA0C60145A6AD62DD3DA7B080F2.TMP"
        6⤵
        
        PID:976
    - - C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:464
      - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\fa7sctau.cmdline"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:560
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES878A.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcAC5ADF706DFB4E2D98620DD88F5F776.TMP"
        7⤵
        
        PID:2880
      - C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2300
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\bxsiibfd.cmdline"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:2424
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8A2A.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc6F5D89891E4847E5B7C36E8892C53861.TMP"
        8⤵
        
        PID:3384
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:4004
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\2hw-tkxz.cmdline"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:2728
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8CAB.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcAE2031BEEC74AD8A9FBAB94ACB520D2.TMP"
        9⤵
        
        PID:4648
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:1916
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\thvb12uj.cmdline"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:3796
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8EDD.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc34D4FC254DD04B4691F197CB713619D5.TMP"
        10⤵
        
        PID:2372
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:4260
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\fafka6fg.cmdline"
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:2240
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES918D.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc8366A6EC437048FAB5415836483BEB3.TMP"
        11⤵
        
        PID:2408
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:1432
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\31cgtko3.cmdline"
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:3616
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES93B0.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcC42036A7D7EF4ED391F8FEDC41F43880.TMP"
        12⤵
        
        PID:2580
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:4532
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\scsvqla8.cmdline"
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:4792
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES96CC.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc109BCB13978C4F75992F528C615BB6D.TMP"
        13⤵
        
        PID:976
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:3096
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\jtxknv53.cmdline"
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:3752
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES993D.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcB8897C76D6F54B0AB04DD7CAD5A91FA2.TMP"
        14⤵
        
        PID:4972
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:2824
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\uq3o8qmo.cmdline"
        14⤵
        Suspicious use of WriteProcessMemory
        
        PID:1408
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9BED.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc57F2035AEB46410889842710F72530F5.TMP"
        15⤵
        
        PID:3320
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        14⤵
        Suspicious use of WriteProcessMemory
        
        PID:4100
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\jbxeylf9.cmdline"
        15⤵
        Suspicious use of WriteProcessMemory
        
        PID:3152
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9DE1.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc2D236B024DA44F0FB38DF74E89B3B38.TMP"
        16⤵
        
        PID:1656
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        15⤵
        Suspicious use of WriteProcessMemory
        
        PID:3896
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\am5ukxpv.cmdline"
        16⤵
        Suspicious use of WriteProcessMemory
        
        PID:3756
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9FE5.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcE7F40B34D0DF49E4B9D95E79AC3C442.TMP"
        17⤵
        
        PID:3668
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        16⤵
        Suspicious use of WriteProcessMemory
        
        PID:4816
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\jgthqwm3.cmdline"
        17⤵
        Suspicious use of WriteProcessMemory
        
        PID:3524
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA284.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc33510E6A473D4EACAF286E07519ADC5.TMP"
        18⤵
        
        PID:2392
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        17⤵
        Suspicious use of WriteProcessMemory
        
        PID:1548
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\zs6mzdbw.cmdline"
        18⤵
        Suspicious use of WriteProcessMemory
        
        PID:2008
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA469.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc37D888552D64991A11A1A474A86677.TMP"
        19⤵
        
        PID:3772
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        18⤵
        Suspicious use of WriteProcessMemory
        
        PID:2104
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\pio7f8wa.cmdline"
        19⤵
        Suspicious use of WriteProcessMemory
        
        PID:3952
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA66C.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcB624D5F293D440198343E873ED1916A.TMP"
        20⤵
        
        PID:1080
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        19⤵
        Suspicious use of WriteProcessMemory
        
        PID:1712
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\nunn3wzf.cmdline"
        20⤵
        Suspicious use of WriteProcessMemory
        
        PID:4656
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA832.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcDB7D170FC903462C8A91581DC6D6E96.TMP"
        21⤵
        
        PID:1404
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        20⤵
        Suspicious use of WriteProcessMemory
        
        PID:4604
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\34xtjcah.cmdline"
        21⤵
        Suspicious use of WriteProcessMemory
        
        PID:4616
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA9D7.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc7A8CA6FAF4804EBDAE78417D91FEB87D.TMP"
        22⤵
        
        PID:3728
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        21⤵
        Suspicious use of WriteProcessMemory
        
        PID:2744
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\apoupjns.cmdline"
        22⤵
        Suspicious use of WriteProcessMemory
        
        PID:1044
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESABBC.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc2BD2445E69CD4572871475C6871BEAD.TMP"
        23⤵
        
        PID:2256
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        22⤵
        Suspicious use of WriteProcessMemory
        
        PID:1232
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\g-04ocql.cmdline"
        23⤵
        
        PID:4076
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAD81.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc746BE8C937B4AD0B720BAFC2222CEF7.TMP"
        24⤵
        
        PID:4280
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        23⤵
        
        PID:2924
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\-rezjhcy.cmdline"
        24⤵
        
        PID:3480
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAF56.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc1F8E50CE94FA4E0D816A543D523A8B7.TMP"
        25⤵
        
        PID:1132
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        24⤵
        
        PID:3548
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\j-uwctnu.cmdline"
        25⤵
        
        PID:1372
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB0FC.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc78B43FD79FE4479B3C786A2806A1D91.TMP"
        26⤵
        
        PID:4344
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        25⤵
        
        PID:3024
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\7ge7x1ke.cmdline"
        26⤵
        
        PID:4832
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB282.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcE652468FDE7D4DDA97B453305FD277F4.TMP"
        27⤵
        
        PID:3032
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        26⤵
        
        PID:2588
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\zo2b1jkz.cmdline"
        27⤵
        
        PID:3680
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB447.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc2A69FEACA0AE43B38F93BCCF1F38E865.TMP"
        28⤵
        
        PID:624
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        27⤵
        
        PID:1948
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\njr2azm2.cmdline"
        28⤵
        
        PID:3488
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB62C.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc9400BB5D93304A30B5FC6A9B4E5A5080.TMP"
        29⤵
        
        PID:1884
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        28⤵
        
        PID:4956
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\lsixe23b.cmdline"
        29⤵
        
        PID:1760
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB7F1.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc486C7CEDEDFB41A38AA2FFD2BA7C7BB.TMP"
        30⤵
        
        PID:3452
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        29⤵
        
        PID:4856
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\2eyx9p6e.cmdline"
        30⤵
        
        PID:5044
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB977.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc65E3017545F041ED8308D7FDEA429D9.TMP"
        31⤵
        
        PID:3112
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        30⤵
        
        PID:2264
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\nby-nfgf.cmdline"
        31⤵
        
        PID:1820
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESBB0E.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc6FD1EC97F5384919A9EA72481E39D048.TMP"
        32⤵
        
        PID:396
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        31⤵
        
        PID:4072
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\psgotat6.cmdline"
        32⤵
        
        PID:1340
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESBD7F.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcFFC3D60C791D4DA3B9357D30A4CBD3DC.TMP"
        33⤵
        
        PID:4764
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        32⤵
        
        PID:3652
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\fnessu6e.cmdline"
        33⤵
        
        PID:4848
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESBF73.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc5293FA43BF54ED8B1D66515E2EC9494.TMP"
        34⤵
        
        PID:556
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        33⤵
        
        PID:3836
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\hb8xokml.cmdline"
        34⤵
        
        PID:4836
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC167.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc4589C62E899422A9D59D4887E521B6C.TMP"
        35⤵
        
        PID:5012
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        34⤵
        
        PID:1928
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ko7fqqck.cmdline"
        35⤵
        
        PID:624
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC34B.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc57C0205F94BB4ED6B9FD3D8C8755D5D.TMP"
        36⤵
        
        PID:3716
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        35⤵
        
        PID:4480
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\edxp-rg5.cmdline"
        36⤵
        
        PID:2740
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC53F.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcB300317FB83B48D4AEB739ECCC68CED.TMP"
        37⤵
        
        PID:4576
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        36⤵
        
        PID:2832
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\qz49d6v6.cmdline"
        37⤵
        
        PID:2908
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC714.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcA4D4A8F31920477D9E1210B3C3B3F96A.TMP"
        38⤵
        
        PID:4524
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        37⤵
        
        PID:3372
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\8dxbypqp.cmdline"
        38⤵
        
        PID:1832
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC908.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc15929F653DA0430C969ED6D83B8A0F2.TMP"
        39⤵
        
        PID:4728
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        38⤵
        
        PID:4920
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\juipi4_0.cmdline"
        39⤵
        
        PID:4440
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCAEC.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcB5D6DEA92B04498BBD113C44DD768A3A.TMP"
        40⤵
        
        PID:1200
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        39⤵
        
        PID:3668
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ftloc-zs.cmdline"
        40⤵
        
        PID:4240
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCC92.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc9516C3DF1685432A99E2A1E14C276B.TMP"
        41⤵
        
        PID:1312
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        40⤵
        
        PID:2392
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\6fntommz.cmdline"
        41⤵
        
        PID:4336
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCE38.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc5357882A67DB4359A6386A75923D3443.TMP"
        42⤵
        
        PID:3456
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        41⤵
        
        PID:4444
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\mtw40ti1.cmdline"
        42⤵
        
        PID:3260
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD05B.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcBC783C7BF937428FA94A8085B01DA414.TMP"
        43⤵
        
        PID:3528
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        42⤵
        
        PID:4876
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\tndexgwo.cmdline"
        43⤵
        
        PID:2312
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD210.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc719E010DE35E4E7585EBF5D7E6AB9A.TMP"
        44⤵
        
        PID:4696
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        43⤵
        
        PID:4276
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ladsvyz9.cmdline"
        44⤵
        
        PID:2136
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD3D5.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcD0A139C0398442D58F70984B5FF794C7.TMP"
        45⤵
        
        PID:1220
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        44⤵
        
        PID:4184
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ldrbhjou.cmdline"
        45⤵
        
        PID:3156
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD5C9.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcD03FB2877BE4ED4A9CD4F295723BF18.TMP"
        46⤵
        
        PID:3112
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        45⤵
        
        PID:2916
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\zlt2uzww.cmdline"
        46⤵
        
        PID:3360
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD760.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc8F60E4E4386044B8BA3873D592EAF498.TMP"
        47⤵
        
        PID:3820
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        46⤵
        
        PID:4400
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\gxlkpucb.cmdline"
        47⤵
        
        PID:3992
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD944.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcF5AFEFE5AD34459D869FC983446CA14.TMP"
        48⤵
        
        PID:4700
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        47⤵
        
        PID:1312
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\oxxjmju6.cmdline"
        48⤵
        
        PID:3388
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESDB19.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc31CDB6B27B7E4E8BB7DA6A19024805C.TMP"
        49⤵
        
        PID:1472
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        48⤵
        
        PID:4244
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\umh3_ec7.cmdline"
        49⤵
        
        PID:2888
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESDCEE.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc33A75343D94249ADA52A666C4D1550A8.TMP"
        50⤵
        
        PID:1940
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        49⤵
        
        PID:1556
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\9e8betkq.cmdline"
        50⤵
        
        PID:3848
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESDEE2.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc3E3C2F861DEE48759871E55D6AD5E25D.TMP"
        51⤵
        
        PID:4108
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        50⤵
        
        PID:3728
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\rgffhfwz.cmdline"
        51⤵
        
        PID:888
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE078.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc603BB8E4BD6D46A2AC8AA0A28EF9BD94.TMP"
        52⤵
        
        PID:4556
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        51⤵
        
        PID:1892
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\z0ul03jr.cmdline"
        52⤵
        
        PID:2320
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE23D.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcC2F13AC3CFC745C1B51B3FE3E279D41.TMP"
        53⤵
        
        PID:3588
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        52⤵
        
        PID:3404
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\iqlzxz9s.cmdline"
        53⤵
        
        PID:3184
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE441.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc5554D345DBDC43FCB5C537F648A769DF.TMP"
        54⤵
        
        PID:4700
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        53⤵
        
        PID:4764
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\qpoahnz1.cmdline"
        54⤵
        
        PID:2144
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE644.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc50544696C4444F7587E9279B30E7291C.TMP"
        55⤵
        
        PID:4264
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        54⤵
        
        PID:4228
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\3zkmgayh.cmdline"
        55⤵
        
        PID:1620
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE809.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcA8C0FAC3FC741CCB9BCC2B43377E339.TMP"
        56⤵
        
        PID:1804
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        55⤵
        
        PID:4404
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\tywg7h82.cmdline"
        56⤵
        
        PID:976
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESEA0D.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc5992DB6AB29D4C70B2332C866AC8BEA3.TMP"
        57⤵
        
        PID:4108
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        56⤵
        
        PID:4032
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\4hz9pdi1.cmdline"
        57⤵
        
        PID:980
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESEBF1.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc79D1697AC51541B1B4C048AFE336C5DB.TMP"
        58⤵
        
        PID:4556
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        57⤵
        
        PID:312
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\8qxmpdan.cmdline"
        58⤵
        
        PID:1920
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESEDB6.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcB121F3C9738042AF8413AE5791B9431.TMP"
        59⤵
        
        PID:2884
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        58⤵
        
        PID:1356
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\z8q323kc.cmdline"
        59⤵
        
        PID:2980
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESEFAA.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc2EAD27A8C26247BEABB03F1DDEDA76C4.TMP"
        60⤵
        
        PID:2236
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        59⤵
        
        PID:924
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\m5ztxgvh.cmdline"
        60⤵
        
        PID:1200
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF131.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc150CD8F6CD0F492D8BD8D0DC74EC2241.TMP"
        61⤵
        
        PID:2400
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        60⤵
        
        PID:2080
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\uuzy6kko.cmdline"
        61⤵
        
        PID:4780
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF315.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc55215DB357F84B3B92FA9092F987BF3C.TMP"
        62⤵
        
        PID:4376
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        61⤵
        
        PID:3572
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ui2iciv4.cmdline"
        62⤵
        
        PID:2372
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF4EA.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc1BCF271975FE48E9A56BE2E1E57BD868.TMP"
        63⤵
        
        PID:4108
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        62⤵
        
        PID:2152
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\pil-ukml.cmdline"
        63⤵
        
        PID:4952
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF6A0.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc4B498B2ADBB8445481686F8DE510510.TMP"
        64⤵
        
        PID:3624
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        63⤵
        
        PID:4288
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\uombvdog.cmdline"
        64⤵
        
        PID:1088
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF8A3.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc39551CD9DC4F44A7BE44644AE15DE86D.TMP"
        65⤵
        
        PID:3820
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        64⤵
        
        PID:636
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\5lxzfifn.cmdline"
        65⤵
        
        PID:1164
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFA59.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcA6F45B753BC844428930CD71CA930EE.TMP"
        66⤵
        
        PID:2364
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        65⤵
        
        PID:1236
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ijgndl03.cmdline"
        66⤵
        
        PID:1112
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFC6C.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcD779FE78685047B4912DF04C8A8266C.TMP"
        67⤵
        
        PID:2972
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        66⤵
        
        PID:716
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\qilxxflp.cmdline"
        67⤵
        
        PID:1864
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFE31.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc7D4CDA55C6024507A4BC17DFA7414BB7.TMP"
        68⤵
        
        PID:3772
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        67⤵
        
        PID:3344
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\j9epzs2p.cmdline"
        68⤵
        
        PID:2708
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc8C8FFF3373E5489D94DCE9CA75B21977.TMP"
        69⤵
        
        PID:3064
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        68⤵
        
        PID:4536
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\hsp46buv.cmdline"
        69⤵
        
        PID:2628
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1EA.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc97E6A0B74A534278B9E35A42BF16434.TMP"
        70⤵
        
        PID:4068
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        69⤵
        
        PID:3440
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\7p4tk3f0.cmdline"
        70⤵
        
        PID:2532
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3DE.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcD2343FF4D538425B9377CA5387C990C9.TMP"
        71⤵
        
        PID:4280
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        70⤵
        
        PID:5056
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\1tkg8qoz.cmdline"
        71⤵
        
        PID:4232
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5C3.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc28A13C0D95684C6BB6DE6758E6B74D50.TMP"
        72⤵
        
        PID:1796
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        71⤵
        
        PID:3780
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\qkdp2hs5.cmdline"
        72⤵
        
        PID:4164
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES778.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcFBCC7353336E4C3187B44C333B2F6D.TMP"
        73⤵
        
        PID:3864
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        72⤵
        
        PID:4080
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\zlz9tamp.cmdline"
        73⤵
        
        PID:3860
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES93D.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc490DB61D9E344E5BAC1B9D169DB3BBB1.TMP"
        74⤵
        
        PID:864
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        73⤵
        
        PID:3516
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\budsds6x.cmdline"
        74⤵
        
        PID:1384
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB22.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcF87DFBEA111D4591B2A1511DCB26B35E.TMP"
        75⤵
        
        PID:4256
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        74⤵
        
        PID:4960
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\x3lhxhvj.cmdline"
        75⤵
        
        PID:1380
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCC8.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc28507DCE93C4232BB857BAA89AF15DA.TMP"
        76⤵
        
        PID:1048
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        75⤵
        
        PID:4936
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\m_h7olhh.cmdline"
        76⤵
        
        PID:4580
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE8D.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc2166991BC2D24C08B3F083CCA365147.TMP"
        77⤵
        
        PID:4524
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        76⤵
        
        PID:4704
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\qyh0oql4.cmdline"
        77⤵
        
        PID:2236
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1061.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcC719251D54B04F4A8BDA920F4869C14.TMP"
        78⤵
        
        PID:2268
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        77⤵
        
        PID:2032
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\bnhfhlhd.cmdline"
        78⤵
        
        PID:2972
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1217.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc30FFA425D1F426C9FF86247F0AF5C54.TMP"
        79⤵
        
        PID:1332
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        78⤵
        
        PID:676
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ww-7s4kb.cmdline"
        79⤵
        
        PID:1504
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES13AD.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcEF36B86D71294EBE9046A3BBEB60DC.TMP"
        80⤵
        
        PID:1080
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        79⤵
        
        PID:4972
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\oj3yzcx-.cmdline"
        80⤵
        
        PID:4364
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1553.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc524BD32171E449549B6E384F42645BF.TMP"
        81⤵
        
        PID:3980
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        80⤵
        
        PID:5012
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\itdnjxra.cmdline"
        81⤵
        
        PID:4976
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1709.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc3DFC43346E9E4EC59382A26EAAE3512D.TMP"
        82⤵
        
        PID:1924
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        81⤵
        
        PID:3824
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\mqtklqur.cmdline"
        82⤵
        
        PID:1428
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1870.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcB6C094A230FC41B2B4EEA651769EB75.TMP"
        83⤵
        
        PID:4740
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        82⤵
        
        PID:2784
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\nt9jad3b.cmdline"
        83⤵
        
        PID:4648
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1A25.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcA08CDECD1D5140B18EC7B3AFBF5CD13F.TMP"
        84⤵
        
        PID:3064
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        83⤵
        
        PID:4236
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\bcd51qks.cmdline"
        84⤵
        
        PID:4324
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1BCB.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc1151D678D7C4DF2992FF477AE2263C4.TMP"
        85⤵
        
        PID:5048
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        84⤵
        
        PID:2480
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\vvkcjmox.cmdline"
        85⤵
        
        PID:4744
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1D23.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc8D467C87B84E4037AE6C90F91C36DB1.TMP"
        86⤵
        
        PID:2204
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        85⤵
        
        PID:1472
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\3qr8jskx.cmdline"
        86⤵
        
        PID:4968
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1EF8.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc8F466943E5B848258F9B8C811ED32ABB.TMP"
        87⤵
        
        PID:4264
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        86⤵
        
        PID:3032
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\wrxqucy-.cmdline"
        87⤵
        
        PID:2192
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES205F.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc107F9816AF4464F8EFFAB71C14CB2B4.TMP"
        88⤵
        
        PID:4928
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        87⤵
        
        PID:2388
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\yvghjean.cmdline"
        88⤵
        
        PID:4556
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES21F5.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcDD0DCD487CE44F3D9638DA3E1E362D2.TMP"
        89⤵
        
        PID:1152
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        88⤵
        
        PID:432
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\1bvbikv0.cmdline"
        89⤵
        
        PID:4012
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES236C.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc4D679CDAB53B4732BA6796A13336B0F3.TMP"
        90⤵
        
        PID:1484
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        89⤵
        
        PID:4540
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\widpyktn.cmdline"
        90⤵
        
        PID:4700
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES24E3.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc43FE5E282F7A4099AB873376EDBA274.TMP"
        91⤵
        
        PID:3256
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        90⤵
        
        PID:3748
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ir4goimv.cmdline"
        91⤵
        
        PID:3484
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES264B.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcD97E7EA06BA247BA8AAAC299AF457D67.TMP"
        92⤵
        
        PID:4256
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        91⤵
        
        PID:2484
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\kpmf1kby.cmdline"
        92⤵
        
        PID:3376
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES27D1.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc214A58999C44CD481F155B4487EE3.TMP"
        93⤵
        
        PID:1204
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        92⤵
        
        PID:5052
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\g2zy8ezl.cmdline"
        93⤵
        
        PID:4388
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2977.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc2995F04E6E9A401CAC6D9163B1766523.TMP"
        94⤵
        
        PID:4432
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        93⤵
        
        PID:4636
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\8nptc8va.cmdline"
        94⤵
        
        PID:3224
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2ADF.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc60BC7E8F6FA34CC1A86D582E9FCE999B.TMP"
        95⤵
        
        PID:3520
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        94⤵
        
        PID:4152
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\uj4_c6_s.cmdline"
        95⤵
        
        PID:4572
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2C46.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc965EB252D02F42A5824D0E22F1D9FF4.TMP"
        96⤵
        
        PID:4432
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        95⤵
        
        PID:2552
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\rfet_e9o.cmdline"
        96⤵
        
        PID:4912
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2D9E.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcD989D52BB8124BD48EA396A8A024691B.TMP"
        97⤵
        
        PID:1204
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        96⤵
        
        PID:4268
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\wrjvh3ad.cmdline"
        97⤵
        
        PID:2040
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2EC7.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc33F606CEDE9944D7A41ADD5BDC7543E6.TMP"
        98⤵
        
        PID:1216
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        97⤵
        
        PID:4928
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\6xlvodhi.cmdline"
        98⤵
        
        PID:2324
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES300F.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcA4903BD0F2D5415AA93DB7E685AB4B5.TMP"
        99⤵
        
        PID:2520
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        98⤵
        
        PID:2108
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ymxbmzje.cmdline"
        99⤵
        
        PID:1080
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3483.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc3AB774EEF27E400AA392977A5F367F54.TMP"
        100⤵
        
        PID:3368
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        99⤵
        
        PID:2308
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\hlgmwhyn.cmdline"
        100⤵
        
        PID:400
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES35FA.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc899611F558514E368BFAD5ECB1DA5F6C.TMP"
        101⤵
        
        PID:3064
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        100⤵
        
        PID:4432
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\zvoiuwbr.cmdline"
        101⤵
        
        PID:4272
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES37B0.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc4FC07FB02A26455B9233316617C6D88C.TMP"
        102⤵
        
        PID:1808
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        101⤵
        
        PID:1204
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ciwdozsg.cmdline"
        102⤵
        
        PID:4628
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES38E8.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc8BF9EBDA21114FDBBEB37CB48182856.TMP"
        103⤵
        
        PID:1796
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        102⤵
        
        PID:3284
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\2tufvsjd.cmdline"
        103⤵
        
        PID:1904
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3A21.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcE01E9E68C5AB4D23AEF845269463A8A1.TMP"
        104⤵
        
        PID:392
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        103⤵
        
        PID:3256
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\iqiydv4-.cmdline"
        104⤵
        
        PID:1048
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3C44.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc5D6613F671D40C99A10A1943789605D.TMP"
        105⤵
        
        PID:2204
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        104⤵
        
        PID:380
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\tehisgyr.cmdline"
        105⤵
        
        PID:3620
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3DCA.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc24163FFE40D9430EB3F6D88B54A85E41.TMP"
        106⤵
        
        PID:3624
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        105⤵
        
        PID:4092
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\zvsufuar.cmdline"
        106⤵
        
        PID:5036
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3F51.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc25A363E6E73447CEAFF48F8731C36E.TMP"
        107⤵
        
        PID:3864
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        106⤵
        
        PID:4584
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\selubal8.cmdline"
        107⤵
        
        PID:1828
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES40C8.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcFC219C4662AF4C658EFFCC79B9395D89.TMP"
        108⤵
        
        PID:4888
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        107⤵
        
        PID:4984
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\tinpmkkm.cmdline"
        108⤵
        
        PID:3296
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4220.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc967873C231FE4AE8A8368199E16E76B3.TMP"
        109⤵
        
        PID:652
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        108⤵
        
        PID:3364
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\p1etcfyt.cmdline"
        109⤵
        
        PID:1924
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4368.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc870E4A6C45CE495EB98EEA4E7F6455FD.TMP"
        110⤵
        
        PID:1496
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        109⤵
        
        PID:4576
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\07tytjmt.cmdline"
        110⤵
        
        PID:4888
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES44A0.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc21CBAE3DD0264D08AD6CCFE0A0185E7E.TMP"
        111⤵
        
        PID:1884
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        110⤵
        
        PID:4524
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\bsraj9sk.cmdline"
        111⤵
        
        PID:3984
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4608.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc1FDB62004F924ABBA5BB9173FFFF947.TMP"
        112⤵
        
        PID:2524
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        111⤵
        
        PID:3772
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\hswv1qmk.cmdline"
        112⤵
        
        PID:3980
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4740.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc787F2C5C918845EEA4AF1D204A79D7C7.TMP"
        113⤵
        
        PID:1656
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        112⤵
        
        PID:4452
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\7omoilhe.cmdline"
        113⤵
        
        PID:4784
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4898.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc3370960BC81D496FACEEB292CDF4588E.TMP"
        114⤵
        
        PID:556
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        113⤵
        
        PID:4728
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\-m5b2qtf.cmdline"
        114⤵
        
        PID:4256
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES49E0.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc566203D575B9478598C9A0B89C1A67E1.TMP"
        115⤵
        
        PID:3328
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        114⤵
        
        PID:4384
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\1rjjrlpo.cmdline"
        115⤵
        
        PID:4224
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4B38.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc4F50904FEB8C4264B3FFF1371C349E1F.TMP"
        116⤵
        
        PID:3460
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        115⤵
        
        PID:3504
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\zvnixqkh.cmdline"
        116⤵
        
        PID:3368
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4C80.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcEE8ED31DB0914523B7D670F2BC98D5F.TMP"
        117⤵
        
        PID:3380
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        116⤵
        
        PID:4068
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\iythokhk.cmdline"
        117⤵
        
        PID:4980
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4DC8.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc3E5BBE0DED14740965CBE9F2015792A.TMP"
        118⤵
        
        PID:1484
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        117⤵
        
        PID:2716
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\je08icgn.cmdline"
        118⤵
        
        PID:4436
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4F4F.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc934A5E726B1641808C75578DD1808440.TMP"
        119⤵
        
        PID:996
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        118⤵
        
        PID:556
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\vgedvryc.cmdline"
        119⤵
        
        PID:1708
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES50D5.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc6E8DA30958A94B50ADC98C28ECE31F2.TMP"
        120⤵
        
        PID:2284
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        119⤵
        
        PID:1668
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\k91ko08n.cmdline"
        120⤵
        
        PID:4724
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES520E.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc6608AED6CF3746FEAC93854655886B9.TMP"
        121⤵
        
        PID:1328
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        120⤵
        
        PID:2660
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ls1nhfym.cmdline"
        121⤵
        
        PID:2352
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5375.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc18DADD746AEB492DA8E9477FC5D4D2D5.TMP"
        122⤵
        
        PID:3064
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        121⤵
        
        PID:1880
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ori_ajqs.cmdline"
        122⤵
        
        PID:2404
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES54EC.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcBBCA10BE57C4494BA0231B74BFE122DC.TMP"
        123⤵
        
        PID:4592
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        122⤵
        
        PID:3864
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\7x5o8tre.cmdline"
        123⤵
        
        PID:1216
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5673.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcC2B33F512AC74C79BADA4A8DC4B3F887.TMP"
        124⤵
        
        PID:3880
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        123⤵
        
        PID:1152
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\fxr5n65e.cmdline"
        124⤵
        
        PID:772
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES57EA.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcC9D38C58C30F4A90839E41298686ACE.TMP"
        125⤵
        
        PID:4208
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        124⤵
        
        PID:1988
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\no0grqhk.cmdline"
        125⤵
        
        PID:2900
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5922.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc1400B44C64C4049BEE8AAD8786D797A.TMP"
        126⤵
        
        PID:5072
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        125⤵
        
        PID:2492
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\yxgkmwgn.cmdline"
        126⤵
        
        PID:4904
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5A8A.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc9D808B4E97AC4F588E2B20AF4CE2D67B.TMP"
        127⤵
        
        PID:696
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        126⤵
        
        PID:4740
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ynlate6j.cmdline"
        127⤵
        
        PID:2520
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5BA3.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc7C015CA72982434DB677E4D6D4C07F5E.TMP"
        128⤵
        
        PID:2604
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        127⤵
        
        PID:4508
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\k4xyq2je.cmdline"
        128⤵
        
        PID:1888
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5CFB.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc55418845DB9F4429B29564B236F19FE8.TMP"
        129⤵
        
        PID:3116
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        128⤵
        
        PID:1496
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\yru3jto_.cmdline"
        129⤵
        
        PID:4992
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5E43.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc7C48E7EAEDC440CEA488B656F2E9668C.TMP"
        130⤵
        
        PID:4344
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        129⤵
        
        PID:2604
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\bb-ucsr3.cmdline"
        130⤵
        
        PID:3520
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5F9B.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc1DD6416D95CE496FAA2E8F10FBBE56D6.TMP"
        131⤵
        
        PID:864
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        130⤵
        
        PID:3116
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\fs7-t7qa.cmdline"
        131⤵
        
        PID:4988
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6121.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc47B9F538B20444FA1C4D286305AA6D0.TMP"
        132⤵
        
        PID:4592
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        131⤵
        
        PID:3452
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\-o8yy3n8.cmdline"
        132⤵
        
        PID:3880
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES62A8.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcE8F8F225AF4E7290B137880A05F6.TMP"
        133⤵
        
        PID:3460
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        132⤵
        
        PID:4252
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\0lw3w99y.cmdline"
        133⤵
        
        PID:552
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES643E.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcAC49BC8D8BBC4B2094401BEFA168F214.TMP"
        134⤵
        
        PID:4592
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        133⤵
        
        PID:1852
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\-vz_lemj.cmdline"
        134⤵
        
        PID:3588
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES65B5.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc413C386126DD463591B1A7DA2E845483.TMP"
        135⤵
        
        PID:3112
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        134⤵
        
        PID:2268
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ejcmo7pe.cmdline"
        135⤵
        
        PID:2884
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES673C.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcB999197C767D474DB678631219EB4DF5.TMP"
        136⤵
        
        PID:1452
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        135⤵
        
        PID:1952
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\mmvjakob.cmdline"
        136⤵
        
        PID:4820
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES68D2.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc7160F55FD83C485091233A2A09B9CC3.TMP"
        137⤵
        
        PID:4872
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        136⤵
        
        PID:1156
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\whcicn1a.cmdline"
        137⤵
        
        PID:1704
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6A2A.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc50CA20E9A2274A2AB233EC25AFD559A9.TMP"
        138⤵
        
        PID:1484
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        137⤵
        
        PID:4660
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\w271nodh.cmdline"
        138⤵
        
        PID:864
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6B91.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcC4A88CFE7A0B491080941D79D167EDB3.TMP"
        139⤵
        
        PID:1464
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        138⤵
        
        PID:5072
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\tp85py8_.cmdline"
        139⤵
        
        PID:392
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6D18.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcA1CE4C59335646E5A345FB9FC5B8E522.TMP"
        140⤵
        
        PID:1884
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        139⤵
        
        PID:1332
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\vh_rvjw6.cmdline"
        140⤵
        
        PID:540
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6E70.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc862E300194264F56ABF7BF89F175DCF6.TMP"
        141⤵
        
        PID:3784
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        140⤵
        
        PID:3744
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\xjc7qk74.cmdline"
        141⤵
        
        PID:3960
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6FF6.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcBB55394938CA48C4BD3B723CCD02F9E.TMP"
        142⤵
        
        PID:2284
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        141⤵
        
        PID:3064
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\v8ywzx6a.cmdline"
        142⤵
        
        PID:996
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES718C.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcD26101E59958437AACE4DB934B46B2.TMP"
        143⤵
        
        PID:4448
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        142⤵
        
        PID:4592
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\iwmb-uzu.cmdline"
        143⤵
        
        PID:2284
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES72F4.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcA2ACDEBD75924971AC8EB731308A3561.TMP"
        144⤵
        
        PID:4208
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        143⤵
        
        PID:4760
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ctwmxahc.cmdline"
        144⤵
        
        PID:396
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES743C.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcFC344B4227A84A48B47B4756EF281A5E.TMP"
        145⤵
        
        PID:1324
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        144⤵
        
        PID:4376
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\o-k7mthb.cmdline"
        145⤵
        
        PID:1648
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES75D2.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc1377D10C187E49DAAD5CE57CDFEA741.TMP"
        146⤵
        
        PID:4680
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        145⤵
        
        PID:3904
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\kvhzz4r8.cmdline"
        146⤵
        
        PID:3456
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES772A.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc29E88C42311747CB9DD2829A5D85A9E5.TMP"
        147⤵
        
        PID:3908
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        146⤵
        
        PID:2376
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\xvbgedrl.cmdline"
        147⤵
        
        PID:4872
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7891.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc25B13DEB21704E17A6BBD8D938949363.TMP"
        148⤵
        
        PID:3784
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        147⤵
        
        PID:1276
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\xozl-t2v.cmdline"
        148⤵
        
        PID:2184
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7A08.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcC1E1906230B44810A71D1A41532C99.TMP"
        149⤵
        
        PID:1328
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        148⤵
        
        PID:1656
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\6rgqc8ew.cmdline"
        149⤵
        
        PID:3908
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7B7F.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc1CB5BC1D9E64493A8F8844C53FC951B.TMP"
        150⤵
        
        PID:3128
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        149⤵
        
        PID:372
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\fz4tah8q.cmdline"
        150⤵
        
        PID:1484
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7D16.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc3F076D6D5F13438E828EC064F428976E.TMP"
        151⤵
        
        PID:1452
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        150⤵
        
        PID:2204
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\kfz91e-t.cmdline"
        151⤵
        
        PID:1624
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7EAC.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcDAFA6205A2BE4612AD95DC35A990CA2B.TMP"
        152⤵
        
        PID:3112
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        151⤵
        
        PID:1324
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\nqnenbw-.cmdline"
        152⤵
        
        PID:1632
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8004.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc8DBCB78418804DBF9C3AEBAE6798D422.TMP"
        153⤵
        
        PID:3792
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        152⤵
        
        PID:1020
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\zqs2r_pz.cmdline"
        153⤵
        
        PID:3924
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES819A.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcB0415ECFB62B4A10B02712467E46C170.TMP"
        154⤵
        
        PID:3112
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        153⤵
        
        PID:2396
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\nud3dumr.cmdline"
        154⤵
        
        PID:3872
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8301.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc9859EAE1725C4D7C83EA6D8CABFD9EC4.TMP"
        155⤵
        
        PID:1328
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        154⤵
        
        PID:3460
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\pj3vif9n.cmdline"
        155⤵
        
        PID:4180
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8459.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcC910421FB7BA434EACCA45C0903774CA.TMP"
        156⤵
        
        PID:696
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        155⤵
        
        PID:1452
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\gccgjutt.cmdline"
        156⤵
        
        PID:4828
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8591.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc54601F6B1D6B4FC98432AC34BAC696B6.TMP"
        157⤵
        
        PID:3204
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        156⤵
        
        PID:876
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\y2oltyqd.cmdline"
        157⤵
        
        PID:3128
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES86DA.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc4485A6A9C87C4FA7A6D93140383A37AF.TMP"
        158⤵
        
        PID:3380
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        157⤵
        
        PID:2084
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\i4wnxatv.cmdline"
        158⤵
        
        PID:1320
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8812.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc4367E2E3397A4A439FC0E37C506A46C9.TMP"
        159⤵
        
        PID:3328
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        158⤵
        
        PID:2596
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\6gcpiewn.cmdline"
        159⤵
        
        PID:2992
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES894B.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc77356F7E9D54877A819D7344DF549E.TMP"
        160⤵
        
        PID:2648
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        159⤵
        
        PID:4108
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\9dxof9g3.cmdline"
        160⤵
        
        PID:2340
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8A83.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc39C013707A84972AB8FF724AA45B17E.TMP"
        161⤵
        
        PID:2860
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        160⤵
        
        PID:2648
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ip3jkgsi.cmdline"
        161⤵
        
        PID:1808
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8BCB.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc253D9079234B4134A799AAFD5496C50.TMP"
        162⤵
        
        PID:3380
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        161⤵
        
        PID:960
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\p_kpfncc.cmdline"
        162⤵
        
        PID:2524
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8D42.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc45EA7EF11A70404C903E272864AEB8FE.TMP"
        163⤵
        
        PID:5140
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        162⤵
        
        PID:5168
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\zxm0-hnj.cmdline"
        163⤵
        
        PID:5220
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8E8A.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcC6D7B8187CD64F649840F88A21DF6DF7.TMP"
        164⤵
        
        PID:5288
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        163⤵
        
        PID:5316
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ry9seoby.cmdline"
        164⤵
        
        PID:5368
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8FA4.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc5A8813CA67F24E6AAE846B2323FC454.TMP"
        165⤵
        
        PID:5436
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        164⤵
        
        PID:5464
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ulwvl-cx.cmdline"
        165⤵
        
        PID:5512
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES90FB.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc77181B4098674D27B9654E351C8E1E6F.TMP"
        166⤵
        
        PID:5584
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        165⤵
        
        PID:5612
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\zlzon2mi.cmdline"
        166⤵
        
        PID:5660
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9234.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcE71E257493744C30AAAD9C78769BDC2.TMP"
        167⤵
        
        PID:5728
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        166⤵
        
        PID:5756
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\h72aq8io.cmdline"
        167⤵
        
        PID:5804
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES937C.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc5F137330DC7E42148737990EED7FB92.TMP"
        168⤵
        
        PID:5872
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        167⤵
        
        PID:5900
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\to34myue.cmdline"
        168⤵
        
        PID:5948
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES94D4.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc1938BC8EDBFE474F9621EAE640DE7B7.TMP"
        169⤵
        
        PID:6016
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        168⤵
        
        PID:6044
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\2ybx75tt.cmdline"
        169⤵
        
        PID:6092
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES961C.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc4B1FDF9698B64D25BE496F747FF47046.TMP"
        170⤵
        
        PID:5152
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        169⤵
        
        PID:3380
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\mz5xkt3t.cmdline"
        170⤵
        
        PID:5176
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9783.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc29AC9736D3A485E8F3867766AA5EDB7.TMP"
        171⤵
        
        PID:5288
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        170⤵
        
        PID:5256
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\d3rqt-zs.cmdline"
        171⤵
        
        PID:5336
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES98AC.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcD18C85D11EEC4B729D501CDEDD079D6.TMP"
        172⤵
        
        PID:5416
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        171⤵
        
        PID:5380
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\k8nrduxq.cmdline"
        172⤵
        
        PID:5508
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9A90.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc9C9F53286EC4C29B1B81C36668D8C6D.TMP"
        173⤵
        
        PID:5540
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        172⤵
        
        PID:5524
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\aducasaz.cmdline"
        173⤵
        
        PID:4568
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9C07.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcF3D123D23AC24EC993568A8F9EE656C6.TMP"
        174⤵
        
        PID:5708
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        173⤵
        
        PID:5728
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ochwx6xq.cmdline"
        174⤵
        
        PID:5800
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9D5F.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc44709771BE7B41D8A8AB31586F93271.TMP"
        175⤵
        
        PID:5852
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        174⤵
        
        PID:5912
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\atc69xf4.cmdline"
        175⤵
        
        PID:4692
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9E88.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc1FE40754B54641A3BB2CF691328B8445.TMP"
        176⤵
        
        PID:6036
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        175⤵
        
        PID:5988
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\otggjqmi.cmdline"
        176⤵
        
        PID:5916
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9FC1.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc5A09C1291B6B4AD3AEE58A71C340B0B.TMP"
        177⤵
        
        PID:5148
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        176⤵
        
        PID:6096
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\bm1pms6h.cmdline"
        177⤵
        
        PID:6048
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA0F9.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc8D1B0B3861EB4BD889EA3C284D8B71BC.TMP"
        178⤵
        
        PID:5268
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        177⤵
        
        PID:5276
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\equsv6zx.cmdline"
        178⤵
        
        PID:1160
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA260.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcEEDE53AA2AA84DB8AC5BD86477D4211D.TMP"
        179⤵
        
        PID:5448
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        178⤵
        
        PID:5364
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\lzubthkw.cmdline"
        179⤵
        
        PID:1644
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA399.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc625DA3E36C29474C8B64142BEA989A26.TMP"
        180⤵
        
        PID:5588
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        179⤵
        
        PID:5580
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ug2gzfsa.cmdline"
        180⤵
        
        PID:5476
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA4E1.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcD1258A7789DB41199167841841E24D70.TMP"
        181⤵
        
        PID:5736
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        180⤵
        
        PID:5752
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\yqcj-dmk.cmdline"
        181⤵
        
        PID:5828
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA639.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc243315D712864611A3CA57E2D869F0F3.TMP"
        182⤵
        
        PID:5872
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        181⤵
        
        PID:5896
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\wvuuenqw.cmdline"
        182⤵
        
        PID:408
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA791.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc46E9162F89B343769661AE2E9393603D.TMP"
        183⤵
        
        PID:5964
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        182⤵
        
        PID:5944
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\bh0vvp7n.cmdline"
        183⤵
        
        PID:3700
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA8D9.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc599A8CEBD2E74C8E8D507DE2E29F8A8F.TMP"
        184⤵
        
        PID:5132
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        183⤵
        
        PID:6104
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\kvhouj8k.cmdline"
        184⤵
        
        PID:5216
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAA40.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc87083D959CFD49A7BCAE5777CAD96AE8.TMP"
        185⤵
        
        PID:5300
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        184⤵
        
        PID:6076
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\qgor9-bj.cmdline"
        185⤵
        
        PID:5388
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAB79.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcDC12E394DBD443DFAB7D6B63151258.TMP"
        186⤵
        
        PID:5420
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        185⤵
        
        PID:1884
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\cusdoo_v.cmdline"
        186⤵
        
        PID:1836
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESACE0.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc1992E1CBF5184CF39F4912CD619C77.TMP"
        187⤵
        
        PID:5588
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        186⤵
        
        PID:5564
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\tldmccfi.cmdline"
        187⤵
        
        PID:5460
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAE47.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc72FB7616B6040C2B47EE97A2C76FD.TMP"
        188⤵
        
        PID:5736
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        187⤵
        
        PID:5748
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\lf5x7lfj.cmdline"
        188⤵
        
        PID:5608
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAF8F.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc7019DAF6A52D43FCA236F8913CE93BC3.TMP"
        189⤵
        
        PID:5852
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        188⤵
        
        PID:5848
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ygjflvig.cmdline"
        189⤵
        
        PID:5932
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB0D8.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcBF6D530EE3C94DD49E103C67745EB868.TMP"
        190⤵
        
        PID:6024
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        189⤵
        
        PID:1856
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\rzyst2mw.cmdline"
        190⤵
        
        PID:6088
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB22F.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcCAE8199CB4D9488F9067EC2E18574B14.TMP"
        191⤵
        
        PID:6068
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        190⤵
        
        PID:5936
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\-y0boma6.cmdline"
        191⤵
        
        PID:5284
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB387.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc7F7C2E013B114905A071FD7A4A99B043.TMP"
        192⤵
        
        PID:5268
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        191⤵
        
        PID:6064
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\1a_au2ea.cmdline"
        192⤵
        
        PID:5372
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB4C0.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc9AEC859D26EC4BD4B5BD6C6CA7FDCDE9.TMP"
        193⤵
        
        PID:5416
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        192⤵
        
        PID:6080
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\dae654jt.cmdline"
        193⤵
        
        PID:5592
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB5F8.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc9D5F6C8C2AAE400382AB2F963A3A4CB1.TMP"
        194⤵
        
        PID:5480
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        193⤵
        
        PID:5472
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ylf9h1qn.cmdline"
        194⤵
        
        PID:5720
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB76F.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc93181C457FBB4F28B93E629FA02093BD.TMP"
        195⤵
        
        PID:5352
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        194⤵
        
        PID:2624
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\m9inmguy.cmdline"
        195⤵
        
        PID:5836
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB8B7.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcCD22CB84EA0A4B23BAFDA7B1912FB54.TMP"
        196⤵
        
        PID:5484
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        195⤵
        
        PID:6036
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\mgwxjmyz.cmdline"
        196⤵
        
        PID:6012
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESBA0F.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcA8DAE6D5BA424520BD7D889656D198D.TMP"
        197⤵
        
        PID:5616
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        196⤵
        
        PID:5148
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\5f3xqhca.cmdline"
        197⤵
        
        PID:3648
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESBB28.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc511BDB76710454EB5EC75A5455C16E1.TMP"
        198⤵
        
        PID:5196
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        197⤵
        
        PID:5192
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\h8nitfct.cmdline"
        198⤵
        
        PID:5288
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESBC61.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc6532EFF7ABF843D894845462F751550.TMP"
        199⤵
        
        PID:5440
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        198⤵
        
        PID:5200
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\9cstulew.cmdline"
        199⤵
        
        PID:5376
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESBDB8.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcC2B632E6F9134FA9985D5F9A43622B3.TMP"
        200⤵
        
        PID:5516
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        199⤵
        
        PID:5332
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\zo2rwjqu.cmdline"
        200⤵
        
        PID:5528
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESBF10.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcE667E1104FF4419786B8D2103F66EAD1.TMP"
        201⤵
        
        PID:5712
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        200⤵
        
        PID:5688
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\itj46pyx.cmdline"
        201⤵
        
        PID:5784
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC049.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcA2417BFCF34044B18FD3E2E3A5E66DDE.TMP"
        202⤵
        
        PID:5824
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        201⤵
        
        PID:4908
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\nf9_7-2a.cmdline"
        202⤵
        
        PID:5876
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC1A0.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc7B914F24C16C43B1B2462B34EBB2F63E.TMP"
        203⤵
        
        PID:5940
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        202⤵
        
        PID:5968
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\f961jzah.cmdline"
        203⤵
        
        PID:5164
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC2E9.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcEFEED4236EDE4CA7AF47552984CA210.TMP"
        204⤵
        
        PID:5268
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        203⤵
        
        PID:5264
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\gyydbl1g.cmdline"
        204⤵
        
        PID:5928
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC411.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc43017671C1BF4DE3A381A6E9C98DF95.TMP"
        205⤵
        
        PID:5416
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        204⤵
        
        PID:6132
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\1n9xfo8b.cmdline"
        205⤵
        
        PID:4204
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC54A.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcA683E53D619A4D5789C2CB9F6E2D0E.TMP"
        206⤵
        
        PID:5488
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        205⤵
        
        PID:2860
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ec1twz3z.cmdline"
        206⤵
        
        PID:5656
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC682.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcBBBA316767AF4F5387F1A092EB565957.TMP"
        207⤵
        
        PID:5872
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        206⤵
        
        PID:5352
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\p0hdsmic.cmdline"
        207⤵
        
        PID:6016
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC7BB.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc9B36935C7EF445959884EC5C8294919.TMP"
        208⤵
        
        PID:5884
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        207⤵
        
        PID:5272
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\kgqqxgs4.cmdline"
        208⤵
        
        PID:5160
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC913.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcB985425F2C934D60B3F31EB84EA0AD82.TMP"
        209⤵
        
        PID:5424
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        208⤵
        
        PID:5304
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\f5b8bnu4.cmdline"
        209⤵
        
        PID:5392
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCA2C.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc245BA266DFCB438CA58359964CA3751D.TMP"
        210⤵
        
        PID:1776
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        209⤵
        
        PID:5600
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\np87aspe.cmdline"
        210⤵
        
        PID:5348
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCB45.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc9AC3C54FC2642A1BA1410CF1FC7D1F2.TMP"
        211⤵
        
        PID:5328
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        210⤵
        
        PID:5812
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\zyocfqvj.cmdline"
        211⤵
        
        PID:5624
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCCDB.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcB17C2894AEA4CA2946ED861B19FCD96.TMP"
        212⤵
        
        PID:6004
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        211⤵
        
        PID:5860
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\sm7f4hnt.cmdline"
        212⤵
        
        PID:3392
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCE14.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc572C44DB6CA04539B5DA2AB2854C289.TMP"
        213⤵
        
        PID:5324
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        212⤵
        
        PID:5980
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ql3tqpjw.cmdline"
        213⤵
        
        PID:6100
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCF7B.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcD4EDDD14989B411EAD921D267C99EF3.TMP"
        214⤵
        
        PID:5712
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        213⤵
        
        PID:6056
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\zlu268pe.cmdline"
        214⤵
        
        PID:5544
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD0C3.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc63C8FC073DF247D6BF716498B244EBB5.TMP"
        215⤵
        
        PID:752
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        214⤵
        
        PID:5224
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\p2ixdwyl.cmdline"
        215⤵
        
        PID:3968
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD20C.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcB7D8B847722B4DCD99FE5F331088FC88.TMP"
        216⤵
        
        PID:5644
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        215⤵
        
        PID:1460
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\o918zv6-.cmdline"
        216⤵
        
        PID:5764
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD383.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcA3748688FBDB426E9BDDB5833555507.TMP"
        217⤵
        
        PID:4500
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        216⤵
        
        PID:5312
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\hnv2u2jk.cmdline"
        217⤵
        
        PID:6116
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD4CB.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcBE8BB0B1A20B40F7A8CD47FD4CB7FBFC.TMP"
        218⤵
        
        PID:3332
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        217⤵
        
        PID:5732
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\otsaehuz.cmdline"
        218⤵
        
        PID:5984
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD632.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc734C92F2BE6B4C9EB3622017CF355135.TMP"
        219⤵
        
        PID:5204
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        218⤵
        
        PID:5252
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\yo8r00cg.cmdline"
        219⤵
        
        PID:752
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD78A.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcE5B793BF889F441DA377EBD468271620.TMP"
        220⤵
        
        PID:5496
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        219⤵
        
        PID:5996
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\sdbal8dl.cmdline"
        220⤵
        
        PID:5644
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD8C2.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc77E8923522AF4F2995B8F112CD72691.TMP"
        221⤵
        
        PID:5572
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        220⤵
        
        PID:5484
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\k1dlpy9a.cmdline"
        221⤵
        
        PID:5456
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESDA2A.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc7CACEF05724D419B8389BFB56B5F3DF.TMP"
        222⤵
        
        PID:5228
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        221⤵
        
        PID:5616
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\q6agcpnf.cmdline"
        222⤵
        
        PID:5152
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESDB72.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc9B11EACEBA9549BFBA59992C6DAEB1F0.TMP"
        223⤵
        
        PID:5384
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        222⤵
        
        PID:5776
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\mgr2agnq.cmdline"
        223⤵
        
        PID:608
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESDCAA.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc23B5ACE947C458FB6B419D3972A986E.TMP"
        224⤵
        
        PID:5864
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        223⤵
        
        PID:5408
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\3aumkqqh.cmdline"
        224⤵
        
        PID:5420
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESDE12.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc41C4DE55CA124D4C8292DECA45A71B1.TMP"
        225⤵
        
        PID:5640
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        224⤵
        
        PID:5884
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\r8pcp2k9.cmdline"
        225⤵
        
        PID:5856
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESDF5A.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcD848D4F0A1384F99B8BA8E5D2B2645C.TMP"
        226⤵
        
        PID:5628
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        225⤵
        
        PID:5228
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\-dadpxdd.cmdline"
        226⤵
        
        PID:5584
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE0C1.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc90776A25F7B84B0DAF7946DF23508683.TMP"
        227⤵
        
        PID:2668
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        226⤵
        
        PID:6040
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\iz9rw1l3.cmdline"
        227⤵
        
        PID:5632
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE219.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc6921770C848D4AC7A5FF176A25D5B59D.TMP"
        228⤵
        
        PID:5180
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        227⤵
        
        PID:4448
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\bzvjf9o_.cmdline"
        228⤵
        
        PID:5516
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE323.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc777748EBF0634C1FB8ABFE37EC3B6752.TMP"
        229⤵
        
        PID:5520
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        228⤵
        
        PID:5588
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\czr7eux3.cmdline"
        229⤵
        
        PID:5244
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE48A.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc25AE8D0CE9114364ADA941460BAD38B.TMP"
        230⤵
        
        PID:5972
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        229⤵
        
        PID:2948
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\bvr5u0en.cmdline"
        230⤵
        
        PID:5048
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE5D2.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc7AFB58F17482480FAFE219129F15C5F.TMP"
        231⤵
        
        PID:5888
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        230⤵
        
        PID:6124
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\9_zkgxqo.cmdline"
        231⤵
        
        PID:320
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE6FB.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc6571AE343DEA458B9D469C6B77D2B47A.TMP"
        232⤵
        
        PID:5404
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        231⤵
        
        PID:5248
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ownvwweu.cmdline"
        232⤵
        
        PID:5576
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE843.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc751978EE73F46ACB0D02F181EDCD731.TMP"
        233⤵
        
        PID:744
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        232⤵
        
        PID:5840
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\tlf305-m.cmdline"
        233⤵
        
        PID:5324
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE9CA.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcCE91850FF2E4570A2877278ACAC6B5.TMP"
        234⤵
        
        PID:4800
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        233⤵
        
        PID:5960
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\1l5b3rrd.cmdline"
        234⤵
        
        PID:5908
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESEB41.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc8F0881019F3F483FB5A0D31FDF499EF7.TMP"
        235⤵
        
        PID:5428
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        234⤵
        
        PID:6112
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\zizr51lp.cmdline"
        235⤵
        
        PID:5212
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESEC79.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc9B98E8E8F5B04853BFCBC2471A6D31FB.TMP"
        236⤵
        
        PID:5920
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        235⤵
        
        PID:5904
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\n6hrwbqk.cmdline"
        236⤵
        
        PID:6004
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESEDE1.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcFA30B39D9A23433292C070473D2556F9.TMP"
        237⤵
        
        PID:6024
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        236⤵
        
        PID:5788
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\-z3lpx-7.cmdline"
        237⤵
        
        PID:1700
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESEF29.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcCEF170913FD4110B53EBACF6DACE69.TMP"
        238⤵
        
        PID:5260
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        237⤵
        
        PID:5504
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\92gszvbi.cmdline"
        238⤵
        
        PID:5300
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF080.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc7362DCFEFE784C36A315A924665DE3CC.TMP"
        239⤵
        
        PID:5628
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        238⤵
        
        PID:5188
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\tqt7wmip.cmdline"
        239⤵
        
        PID:5920
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF1E8.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc80E597A7721B48DBB681389B5CA429A.TMP"
        240⤵
        
        PID:5736
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        239⤵
        
        PID:5620
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\2ttwnlbj.cmdline"
        240⤵
        
        PID:6024
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF330.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc64F002622B644E788DF3A222793848.TMP"
        241⤵
        
        PID:5320
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        240⤵
        
        PID:6136
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\toqvogmj.cmdline"
        241⤵
        
        PID:5832
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF488.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcE24A656FBCD9446CB857F9BE2D43F75.TMP"
        242⤵
        
        PID:6060
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        241⤵
        
        PID:5432
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\gdzwjalu.cmdline"
        242⤵
        
        PID:5596
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF5A1.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc3DE5AD2D9BED439CA8879EDAC9B7EA18.TMP"
        243⤵
        
        PID:5180
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        242⤵
        
        PID:3820
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ftmlpdms.cmdline"
        243⤵
        
        PID:5128
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF708.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcDA7720B91F27445A871C58E5A03037FA.TMP"
        244⤵
        
        PID:5172
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        243⤵
        
        PID:5680
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\gvmiutax.cmdline"
        244⤵
        
        PID:5696
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF831.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcB5CA49647AAB4E858E9FCBAF5F88DF70.TMP"
        245⤵
        
        PID:1092
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        244⤵
        
        PID:5572
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\stcjfecj.cmdline"
        245⤵
        
        PID:4500
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF999.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc3974C70D6DF142D8AFC015A6AF770EA.TMP"
        246⤵
        
        PID:5236
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        245⤵
        
        PID:5864
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\j1jpi3-t.cmdline"
        246⤵
        
        PID:5280
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFB00.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc86E56A97DC9443DD92EB27391E9CF495.TMP"
        247⤵
        
        PID:6120
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        246⤵
        
        PID:6008
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\wlspsxle.cmdline"
        247⤵
        
        PID:5196
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFC48.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcD4C7595486D14925837014DB3A8478BF.TMP"
        248⤵
        
        PID:4788
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        247⤵
        
        PID:1092
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\4gv-9hxk.cmdline"
        248⤵
        
        PID:5268
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFD71.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc8058476AD2944CDEAC1B92303E8356F.TMP"
        249⤵
        
        PID:5132
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        248⤵
        
        PID:4696
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\q1yo0siw.cmdline"
        249⤵
        
        PID:6060
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFEE8.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcA1930E9725024BB580B0DB4260F5F141.TMP"
        250⤵
        
        PID:5448
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        249⤵
        
        PID:5628
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\r9eabrlk.cmdline"
        250⤵
        
        PID:5492
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6F.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcC571E56A27D74A93BD2A717AB5565466.TMP"
        251⤵
        
        PID:368
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        250⤵
        
        PID:5232
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\to4habxs.cmdline"
        251⤵
        
        PID:3316
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1E6.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc9AFD328C03430A94DBD1F57084CF5F.TMP"
        252⤵
        
        PID:5548
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        251⤵
        
        PID:5976
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\mcikcvnn.cmdline"
        252⤵
        
        PID:5532
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES33D.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcBEB49BFCFEAF45CCA6AEDCC7D6D72E3.TMP"
        253⤵
        
        PID:5448
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        252⤵
        
        PID:468
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\6y80hw4q.cmdline"
        253⤵
        
        PID:5344
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES485.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc76B7E4457FDD45F4B8AAC6CDD2A82E8E.TMP"
        254⤵
        
        PID:5844
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        253⤵
        
        PID:5744
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\rqrjwpks.cmdline"
        254⤵
        
        PID:744
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES60C.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc80495376F504E20B966C5F1B2E39EAC.TMP"
        255⤵
        
        PID:5144
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        254⤵
        
        PID:5240
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\nhqog7yf.cmdline"
        255⤵
        
        PID:5140
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7B2.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc572C8695BF1D4D56B05802B4ECF5365.TMP"
        256⤵
        
        PID:5972
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        255⤵
        
        PID:5676
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\4pyharkf.cmdline"
        256⤵
        
        PID:5444
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8DB.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc6A518CF9B6B445F84E6BAE06E7FF4F1.TMP"
        257⤵
        
        PID:4392
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        256⤵
        
        PID:5924
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\6_bfnj63.cmdline"
        257⤵
        
        PID:5768
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA42.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc3769E2553E93401DA7B1988A6523AAC.TMP"
        258⤵
        
        PID:5496
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        257⤵
        
        PID:5604
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\uadwtfgx.cmdline"
        258⤵
        
        PID:5668
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESBAA.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc423386299A9B4CE68A2FA328C71056CD.TMP"
        259⤵
        
        PID:4624
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        258⤵
        
        PID:5724
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\qaopyhax.cmdline"
        259⤵
        
        PID:5328
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCF2.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcFC29F9FA27224148909BAB518E047A.TMP"
        260⤵
        
        PID:5648
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        259⤵
        
        PID:5820
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ckttdqj6.cmdline"
        260⤵
        
        PID:5712
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE59.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc3C07B3B356104B8E85676344FC514B.TMP"
        261⤵
        
        PID:6028
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        260⤵
        
        PID:5888
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\0s5cuokr.cmdline"
        261⤵
        
        PID:1940
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFE0.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc331A24DFA2BF4442A5B43449B9A3E7D.TMP"
        262⤵
        
        PID:5340
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        261⤵
        
        PID:5852
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\kijerq8y.cmdline"
        262⤵
        
        PID:368
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1137.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc7CE6CFA5F8C24D4F8099801AA2A28585.TMP"
        263⤵
        
        PID:5004
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        262⤵
        
        PID:4884
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ey9s7l9v.cmdline"
        263⤵
        
        PID:6032
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES12BE.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc12E6D3CC55E74735B632B0BC1320C2.TMP"
        264⤵
        
        PID:5872
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        263⤵
        
        PID:5156
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\o6qwwa-o.cmdline"
        264⤵
        
        PID:6140
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1425.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc9D42DF2172544EF885DF25F27FF11C15.TMP"
        265⤵
        
        PID:5648
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        264⤵
        
        PID:1188
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\o6pvbvfe.cmdline"
        265⤵
        
        PID:5672
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES157D.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc908B9843985340D781679A2C9789ABAF.TMP"
        266⤵
        
        PID:5204
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        265⤵
        
        PID:5760
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\8xvdc234.cmdline"
        266⤵
        
        PID:2252
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES16A6.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc53A2B16DCA1A442386C3631F30C6F2D4.TMP"
        267⤵
        
        PID:5340
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        266⤵
        
        PID:5808
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\mzcf8njs.cmdline"
        267⤵
        
        PID:212
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES17DF.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcF768639A31D74F7DB79A666150A4EC1.TMP"
        268⤵
        
        PID:6120
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        267⤵
        
        PID:5204
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\rv18eohr.cmdline"
        268⤵
        
        PID:5236
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1927.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcD1DDDD934B544E48A9C43B07C3942BF.TMP"
        269⤵
        
        PID:5796
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        268⤵
        
        PID:4056
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\dprhubdt.cmdline"
        269⤵
        
        PID:4088
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1A7E.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc245BE16834C9449B9BE17B81A956B58.TMP"
        270⤵
        
        PID:5780
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        269⤵
        
        PID:5640
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\bfayt45k.cmdline"
        270⤵
        
        PID:3332
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1BB7.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcB9AA7996E824F10BC3139F77FFBBB4.TMP"
        271⤵
        
        PID:6072
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        270⤵
        
        PID:5496
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\y0rbjyyu.cmdline"
        271⤵
        
        PID:2928
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1D0F.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc96EC546EC0E4507A53EA67CC582D85C.TMP"
        272⤵
        
        PID:5548
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        271⤵
        
        PID:5868
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\qtsxsyhb.cmdline"
        272⤵
        
        PID:5700
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1E66.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcD795AD65CCE04A3A9196DFB1E80FB36.TMP"
        273⤵
        
        PID:5404
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        272⤵
        
        PID:5488
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\abm2u-8c.cmdline"
        273⤵
        
        PID:6000
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1FDD.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc73A5FB7157BE4A73827A94C3342FA41.TMP"
        274⤵
        
        PID:5956
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        273⤵
        
        PID:5880
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\bx5-wthr.cmdline"
        274⤵
        
        PID:4392
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2126.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc1E277DA4244544988AA4B9A91F691E57.TMP"
        275⤵
        
        PID:5520
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        274⤵
        
        PID:5184
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\9qz-gtxq.cmdline"
        275⤵
        
        PID:1688
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES226E.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc15E023EC293449FC8519B864C3A1F8C.TMP"
        276⤵
        
        PID:5780
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        275⤵
        
        PID:5952
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ytqtm-6e.cmdline"
        276⤵
        
        PID:3400
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2387.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc5F30ACEB396E45C3A267FBBB96D309A.TMP"
        277⤵
        
        PID:5452
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        276⤵
        
        PID:6128
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\dzfhkkbm.cmdline"
        277⤵
        
        PID:5296
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES250E.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcBAED0B8D8BEC4DBCA61F613970A5D384.TMP"
        278⤵
        
        PID:5260
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        277⤵
        
        PID:3468
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\us9fo6gf.cmdline"
        278⤵
        
        PID:4800
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2685.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc1ABC8C5067CB4F969E95B561BDD41123.TMP"
        279⤵
        
        PID:2668
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        278⤵
        
        PID:5708
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\c45ob7ll.cmdline"
        279⤵
        
        PID:4788
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES27EC.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc246D8A63458E429E8183B5BE6E99D95A.TMP"
        280⤵
        
        PID:3792
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        279⤵
        
        PID:5824
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\mqpcosc4.cmdline"
        280⤵
        
        PID:5844
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2924.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc569ED4B1AB24725917D1210B974ECFA.TMP"
        281⤵
        
        PID:1596
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        280⤵
        
        PID:5940
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\_isue57g.cmdline"
        281⤵
        
        PID:5816
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2A6D.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcF8E03F32C000412F9B4E4FD388F758A0.TMP"
        282⤵
        
        PID:5428
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        281⤵
        
        PID:5412
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\cqsmnckx.cmdline"
        282⤵
        
        PID:5132
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2B95.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc69E223E38E374FEAA5015F41C17308C.TMP"
        283⤵
        
        PID:5144
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        282⤵
        
        PID:5652
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\bedybwdn.cmdline"
        283⤵
        
        PID:6120
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2CFD.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc9A865DB4B374D7990B0D61E056507A.TMP"
        284⤵
        
        PID:5520
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        283⤵
        
        PID:5424
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ievlhq_a.cmdline"
        284⤵
        
        PID:5340
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2E64.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcC48EBB8EE9F548B289ABC15CBF11.TMP"
        285⤵
        
        PID:5180
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        284⤵
        
        PID:5448
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\aqeoiovl.cmdline"
        285⤵
        
        PID:5452
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2FBC.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc14391EC6FEEB422995123194F7654062.TMP"
        286⤵
        
        PID:732
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        285⤵
        
        PID:5548
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\fqlr8ouz.cmdline"
        286⤵
        
        PID:1596
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES30F4.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc78C05B8467404EAAA4A91491A203D59.TMP"
        287⤵
        
        PID:2452
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        286⤵
        
        PID:3792
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\vfaiwztk.cmdline"
        287⤵
        
        PID:6108
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES324C.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc14D37BA725C546CF9328188F1911F7.TMP"
        288⤵
        
        PID:5416
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        287⤵
        
        PID:1776
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ywcujrb6.cmdline"
        288⤵
        
        PID:1292
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3375.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc9476712EF64748378977515A2996D51.TMP"
        289⤵
        
        PID:5416
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        288⤵
        
        PID:5792
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\709nmn5l.cmdline"
        289⤵
        
        PID:5636
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES34BD.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc8299198DA0A5469A97C4E77A47A3B51B.TMP"
        290⤵
        
        PID:5260
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        289⤵
        
        PID:6072
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\vvtcgg_b.cmdline"
        290⤵
        
        PID:5796
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3615.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcC68C780CCD2341A6B331F8408272FA76.TMP"
        291⤵
        
        PID:4624
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        290⤵
        
        PID:6028
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ho8x4dlx.cmdline"
        291⤵
        
        PID:6068
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES376D.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc34745BA3189F4AD1972A152AD483F5A8.TMP"
        292⤵
        
        PID:732
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        291⤵
        
        PID:5972
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\a0labb3u.cmdline"
        292⤵
        
        PID:5416
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES38E4.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc11C1A479AD84471BA8593404EA49EDF.TMP"
        293⤵
        
        PID:5440
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        292⤵
        
        PID:5396
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\8gubybmp.cmdline"
        293⤵
        
        PID:2452
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3A1C.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc119547D049734A2F988D54BAE2FF342.TMP"
        294⤵
        
        PID:5704
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        293⤵
        
        PID:932
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\3xint_fy.cmdline"
        294⤵
        
        PID:5384
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3B55.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc7F9875B0F9A340F2AA21F333566CA6FA.TMP"
        295⤵
        
        PID:1756
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        294⤵
        
        PID:5144
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ptu22jp9.cmdline"
        295⤵
        
        PID:5892
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3CDB.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc1423F218ACCF4ACA85B3BD78DAA2330.TMP"
        296⤵
        
        PID:5740
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        295⤵
        
        PID:5736
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\oug4fcy8.cmdline"
        296⤵
        
        PID:5292
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3E33.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc796DC603FC7C4A51B66017991DB6DF9A.TMP"
        297⤵
        
        PID:5320
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        296⤵
        
        PID:1756
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\bp4kwsdp.cmdline"
        297⤵
        
        PID:5520
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3F8B.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcFFCA520DD2F04C5E8F88F9B96930719F.TMP"
        298⤵
        
        PID:5400
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        297⤵
        
        PID:5872
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ibfae0tx.cmdline"
        298⤵
        
        PID:4732
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES40F2.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc90B07D9B59A4434CB2F1A6E489FCD993.TMP"
        299⤵
        
        PID:5172
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        298⤵
        
        PID:5740
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\5m1nclxy.cmdline"
        299⤵
        
        PID:5440
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES424A.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc31D3DE06C9264255A192BCD75CDBF5AD.TMP"
        300⤵
        
        PID:5560
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        299⤵
        
        PID:5400
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\zxwhusyc.cmdline"
        300⤵
        
        PID:5648
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES43B1.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcC75714F66B804AB3B249B87945CF5C85.TMP"
        301⤵
        
        PID:5500
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        300⤵
        
        PID:5124
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\txftkidp.cmdline"
        301⤵
        
        PID:732
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES44F9.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc3AA21D8C1A334233AD525B329ABD348.TMP"
        302⤵
        
        PID:5180
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        301⤵
        
        PID:1328
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\d8z-v5js.cmdline"
        302⤵
        
        PID:4624
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4642.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc45C378C194FD454DA139428CDAAB775B.TMP"
        303⤵
        
        PID:5172
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        302⤵
        
        PID:5780
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\2n7bzxve.cmdline"
        303⤵
        
        PID:5956
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES47B9.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc352B46ADB0A6441ABD5754D67938AB1.TMP"
        304⤵
        
        PID:6200
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        303⤵
        
        PID:6228
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\v22joo-s.cmdline"
        304⤵
        
        PID:6276
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4930.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcF396C6685F684D80B47E5EB9C3E7F28.TMP"
        305⤵
        
        PID:6344
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        304⤵
        
        PID:6372
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\hvp67mcj.cmdline"
        305⤵
        
        PID:6420
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4A87.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcF7FF61C8CE5D4830B0186652ADB66E29.TMP"
        306⤵
        
        PID:6488
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        305⤵
        
        PID:6516
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ziutcnhu.cmdline"
        306⤵
        
        PID:6564
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4BC0.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc12F49B37FB4D4F1A855BE05141036AD.TMP"
        307⤵
        
        PID:6632
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        306⤵
        
        PID:6660
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\v0a6eiz_.cmdline"
        307⤵
        
        PID:6708
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4D27.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc11939814BACB44FDB13513B7EA94671A.TMP"
        308⤵
        
        PID:6776
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        307⤵
        
        PID:6804
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\dur8piem.cmdline"
        308⤵
        
        PID:6852
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4E7F.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc69C7D01284A48419CFCECC37882EB4.TMP"
        309⤵
        
        PID:6920
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        308⤵
        
        PID:6948
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\bnswtgvq.cmdline"
        309⤵
        
        PID:6996
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4FE6.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcD29314DF3758446EA4CF2144AA53ECFF.TMP"
        310⤵
        
        PID:7056
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        309⤵
        
        PID:7084
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\xecyliuf.cmdline"
        310⤵
        
        PID:7132
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES511F.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc173B621AFA7E40B2875CBD858061EF.TMP"
        311⤵
        
        PID:5428
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        310⤵
        
        PID:5136
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\oljjqp3s.cmdline"
        311⤵
        
        PID:6168
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5296.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcE0BE957A444B15AB5814C118C5911E.TMP"
        312⤵
        
        PID:6268
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        311⤵
        
        PID:6336
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\czgzsprv.cmdline"
        312⤵
        
        PID:6280
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES53DE.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc646166CBB30A4541B59DA6459EEE2D4F.TMP"
        313⤵
        
        PID:6444
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        312⤵
        
        PID:6500
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\folpta-v.cmdline"
        313⤵
        
        PID:6452
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5545.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcF8CCE199124B4BE389A57EF8C5A351DD.TMP"
        314⤵
        
        PID:6580
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        313⤵
        
        PID:6644
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\qn1fz1pn.cmdline"
        314⤵
        
        PID:6632
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES567E.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc5C17B3B31A59459B8858579D18ED6097.TMP"
        315⤵
        
        PID:6764
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        314⤵
        
        PID:6776
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\kadsrg7g.cmdline"
        315⤵
        
        PID:6832
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES57E5.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc6A6F4C0520004DA4B7398D7F6765BB29.TMP"
        316⤵
        
        PID:6916
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        315⤵
        
        PID:6904
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\wx0c-wdz.cmdline"
        316⤵
        
        PID:6824
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES594D.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcA11BC4734144456EB1F5AB7C8FFE523D.TMP"
        317⤵
        
        PID:7060
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        316⤵
        
        PID:7020
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\i9bscto4.cmdline"
        317⤵
        
        PID:6984
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5AB4.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcF83DE53EAF5A459185957B4F53F88730.TMP"
        318⤵
        
        PID:4328
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        317⤵
        
        PID:412
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\h3ifr_zk.cmdline"
        318⤵
        
        PID:7088
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5BFC.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcB0DA8129B0C74EB888AB3366F22372F2.TMP"
        319⤵
        
        PID:6292
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        318⤵
        
        PID:5560
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\s4xzfqjx.cmdline"
        319⤵
        
        PID:6196
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5D44.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc2AB40CA3D4774B5CA29161EE92AA1715.TMP"
        320⤵
        
        PID:6388
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        319⤵
        
        PID:6308
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\e7vldtdc.cmdline"
        320⤵
        
        PID:6460
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5E9C.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcCB1395446624ACF8719735A480D9F4.TMP"
        321⤵
        
        PID:6396
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        320⤵
        
        PID:6600
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\aurgtq_g.cmdline"
        321⤵
        
        PID:6668
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6013.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcAA7DC39AFD1947CA9BFBA2B637C471B.TMP"
        322⤵
        
        PID:6700
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        321⤵
        
        PID:6744
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\6iviz47j.cmdline"
        322⤵
        
        PID:6812
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES616B.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcFA46BF19345C46D18622F1FB3FB043.TMP"
        323⤵
        
        PID:6844
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        322⤵
        
        PID:6756
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\0t0sgwha.cmdline"
        323⤵
        
        PID:7052
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES62D2.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc831948371A3E40599D64C5333A8EF83.TMP"
        324⤵
        
        PID:6956
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        323⤵
        
        PID:6880
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\kgyzxn0_.cmdline"
        324⤵
        
        PID:6020
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES642A.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc372793A480314380AEE464B1B47D84C8.TMP"
        325⤵
        
        PID:7144
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        324⤵
        
        PID:7108
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ay_rol84.cmdline"
        325⤵
        
        PID:6236
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6572.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcA7035637EF74C9AA4F11C24D8866FD3.TMP"
        326⤵
        
        PID:7104
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        325⤵
        
        PID:6324
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\zpllgerx.cmdline"
        326⤵
        
        PID:6312
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6AC1.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc58C6820FA1BB4A0D90BC2681B36E2377.TMP"
        327⤵
        
        PID:6264
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        326⤵
        
        PID:6572
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\a5gmmz4e.cmdline"
        327⤵
        
        PID:6620
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6BCB.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc120AA002C9EA48339174D6C845D71569.TMP"
        328⤵
        
        PID:6472
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        327⤵
        
        PID:6716
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\iuizmjiw.cmdline"
        328⤵
        
        PID:6732
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6D32.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcCD584714D3404D1795A559F5DB2B546A.TMP"
        329⤵
        
        PID:6924
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        328⤵
        
        PID:6692
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\b4bek9fj.cmdline"
        329⤵
        
        PID:6936
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6E7A.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcAC545A5FD86B4793B53ADBE33DEB74C.TMP"
        330⤵
        
        PID:7056
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        329⤵
        
        PID:6944
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\v4rujzag.cmdline"
        330⤵
        
        PID:6980
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6FD2.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc855C7F643C374FA48AA4375E8F4767D.TMP"
        331⤵
        
        PID:7032
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        330⤵
        
        PID:7152
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\einmsx1o.cmdline"
        331⤵
        
        PID:6960
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES711A.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcBF7C36F56DCB4599B5F834121751EF5B.TMP"
        332⤵
        
        PID:4464
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        331⤵
        
        PID:6200
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\f3qwznsk.cmdline"
        332⤵
        
        PID:6180
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7243.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc7BE53CB388F04F6A8AF0B08E69F762F4.TMP"
        333⤵
        
        PID:6356
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        332⤵
        
        PID:6492
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\a3grlkyb.cmdline"
        333⤵
        
        PID:6232
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES739B.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc2C2A826C415F4B4A9F3DBCAEEECB54BF.TMP"
        334⤵
        
        PID:6676
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        333⤵
        
        PID:6448
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\feadzdev.cmdline"
        334⤵
        
        PID:6532
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES74F3.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc7CDBE2D256864B43B45D83ECCC5FE03B.TMP"
        335⤵
        
        PID:6860
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        334⤵
        
        PID:6608
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\scezrtoc.cmdline"
        335⤵
        
        PID:6684
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES760C.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcE0B3910EB4D45458650844025B9AB41.TMP"
        336⤵
        
        PID:6808
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        335⤵
        
        PID:6976
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\kzciyccg.cmdline"
        336⤵
        
        PID:7128
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7764.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcC53A8451D31C4FF082D24FA1427786A9.TMP"
        337⤵
        
        PID:5704
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        336⤵
        
        PID:5568
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\f2u_77ai.cmdline"
        337⤵
        
        PID:7124
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES78BB.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcAF2690DCEF9F4E3DBCF241CC942E80.TMP"
        338⤵
        
        PID:6156
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        337⤵
        
        PID:5004
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\qjpfyd0m.cmdline"
        338⤵
        
        PID:5172
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7A13.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcB8A3FE8DDE8D4C28BD4D996E37DFB416.TMP"
        339⤵
        
        PID:6412
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        338⤵
        
        PID:6256
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ctop1_vf.cmdline"
        339⤵
        
        PID:6392
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7B6B.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcA9418FB34C2048D5A1FCABE14D9BF6BC.TMP"
        340⤵
        
        PID:6628
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        339⤵
        
        PID:6260
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ro2qibaw.cmdline"
        340⤵
        
        PID:6912
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7CE2.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc6E36A00C75CC456D842C7D5E9842411E.TMP"
        341⤵
        
        PID:6552
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        340⤵
        
        PID:6544
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\2cteoeba.cmdline"
        341⤵
        
        PID:7048
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7E0B.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc532C294E4458491586672F5EDFC0A95E.TMP"
        342⤵
        
        PID:7040
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        341⤵
        
        PID:6920
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\t9lvoatg.cmdline"
        342⤵
        
        PID:4352
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7F43.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcE4F51DCD58294461B259BE28D28ECDF3.TMP"
        343⤵
        
        PID:5772
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        342⤵
        
        PID:7072

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0\UsageLogs\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe.log
Size 319B
SHA256 3ad86cf159df245f5a90542366944292c4e79d1b81468d4da9f78804b25f36d0
MD5 3865e90083233524ea2066cec1c0e1f9
SHA1 46675f5064ec75e7a1f0b724eec1e594e795d793
SHA512 8fad6aa496b49660dbe6c6de0f96b37ae60c68827c74450be42bab5d4345201f1377872733f4a45d25ba196ca9fc572aa5a5fa9a87c6a1dc75b4aaadaa8a42f8
TLSH
T17EE07230363584E00C122B100C127FC912EF0327A3A89F0C1610939EEC2A077EB013E2
MD5 SHA1 SHA512 TLSH

Submit Download

2hw-tkxz.cmdline

Path C:\Users\Admin\AppData\Local\Temp\2hw-tkxz.cmdline
Size 138B
SHA256 4fa959da5617c54044a786b13d6bf175fd52654b304bdc31a59a76fe19642e72
MD5 90b184b3f4bef321ecbea3f2769e4657
SHA1 a1a92832626706c7f9f589a4f575e9925b6f2a92
SHA512 df4c995d9bafc576526521cf365dce192d17375adefa2e71f0bb418bf1b39c0c9fd546780b515646976f5589dda9c45075401d74ecc80b841153bea17e28cc8d
TLSH
T1AAC04C05428AC62A2D8A502F55E9519CC0A65E592A553B204A50C65D1242409BA83701
MD5 SHA1 SHA512 TLSH

Submit Download

2hw-tkxz.dll

Path C:\Users\Admin\AppData\Local\Temp\2hw-tkxz.dll
Size 1.6MB
SHA256 63671cf68b6290334d4ebc475f00687f3f4ae41c9169df5fc3c4ee06c1c7316c
MD5 d0ed977d89f8db1b7deeab40fa6b6ca4
SHA1 97a63bee10dc3c6507f0b46af97cf2c7ba33ecad
SHA512 aec8f7b6006cbb314fc0973d45823876e97551e5df42a294d119a1fe330180afdd14d41a139ceafc9f2d133df4730d6a7f8c734220122ddb1058ca44eb56755a
SSDEEP 24576:j1fuQj+YSWPKPa73BaByndTPB3vkM62h7ox08l6h9Jl8+w8q8fP1kv:j1fuQoWPP73BPZl7JVly8Rn1c
TLSH
T10B85F8342DEA102AF173AFBD9BE475AAE91EBBA33707586D1072038A4713942DDC153D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

31cgtko3.cmdline

Path C:\Users\Admin\AppData\Local\Temp\31cgtko3.cmdline
Size 138B
SHA256 e011db1decff376907531159df0895fd293549c6f7569d4884f01ebfe1807d76
MD5 4320cd9d3d1c2e9085002f0dbb3579e7
SHA1 04833d3a7cbbd85c30c3b453f92fd16ae0811f7f
SHA512 2998965c0c407a4d633dd211f0b27a571b18f97abd5d300c5b3f2e4afa32b7e8a306ce4dbd70e9cdde65107660fe4b6613f52c4dc578a1868ec0d5312d608cdc
TLSH
T146C04C019287C62925D5921B55B5519C82F99D0E6E457B345651845E1242409FA83711
MD5 SHA1 SHA512 TLSH

Submit Download

31cgtko3.dll

Path C:\Users\Admin\AppData\Local\Temp\31cgtko3.dll
Size 1.6MB
SHA256 56ba8c2868a26d18cd06946c5c3dd19164bca4254d94a9e15625117cb50ed704
MD5 c1c044063f0a7fc99b472e0ff11fdd9b
SHA1 fee6723b29611e45d1e9eb820d5ef4e0102fb742
SHA512 3351cd58e659e2a74f6ffe7dd2cd35d44717e9ab81f3a9050420e39fc4aab87583f3a8c79f9d271268d84a7694bf3900adfb4edb1eb1fcd2ed3cfee3dc9c970f
SSDEEP 24576:91fuQj+YSWPKPa73BaByndTPB3vkM62h7ox08l6h9Jl8+w8q8fP1kv:91fuQoWPP73BPZl7JVly8Rn1c
TLSH
T17985F8342DEA102AF173AFBD9BE475AAE91EBBA33707586D1072038A4713942DDC153D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RES6CDE.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES6CDE.tmp
Size 1KB
SHA256 45cb85012f6633f9349c2e1f165a738d1066d57c2fc2d08b4eeeb747a1cb101f
MD5 a2b0c3903b399c6841c4fdf2319dda0e
SHA1 e985441b43a89fd056808c160976cb9d47d9758e
SHA512 4e97011e1ba3abb9be9d28b28c863e7e5eac0ae7fd2aa008fcb9e853c8e5957d482a9ebcd3f2915c0bf75ff70c9ee4c3f2080e62f774d32e78c9c972ec3b056b
TLSH
T1A7215C0553E8470EF077473269F6231FA625FDA5DFB2635F854002292C51544EEB1EB2
MD5 SHA1 SHA512 TLSH

Submit Download

RES7182.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES7182.tmp
Size 1KB
SHA256 9e1c76add1dde41a47f882d92b2107bd702466db790a7677ac327a7f3665e9ea
MD5 744842d54d04770ce84d3824777f10d1
SHA1 7dd19c2f069b06def98050e213ab8ad5fb610f1c
SHA512 7692e02bc8ba045a1589c98b4b31533acb7e09ca9eb2e175f89fca7e1f44645a166ea68225d0d0c032de86e0f3ae73abd1db4e09e41152ec7f4f1e911f6d48f5
TLSH
T11B215C05A3E8470FF0734732A9F9032B9229FDA4DFB2D35B858402282C51144EEF1EB2
MD5 SHA1 SHA512 TLSH

Submit Download

RES7635.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES7635.tmp
Size 1KB
SHA256 5d3033a3639d05827d7e1171834d624288cd5db8c188391da426f4581a7e8aee
MD5 e7d7296c88367c8b5a831e53440f28b8
SHA1 8e4ab7dcc77523acb6c0634e4e5c8f393e9cb584
SHA512 0019fd1869a0e29b7a8791711415e512d4a1983483c2ee2f5ca4e9f5faeb452ff24a4c93e346a8bedd43c4be6962eb93df90bc8faa615231a437dc1e9ba73844
TLSH
T1AA213A0553E8470EF0B74B32B9F6532BA235FDA4DFA2A35F8580422D1C51554EEB1AB2
MD5 SHA1 SHA512 TLSH

Submit Download

RES84EA.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES84EA.tmp
Size 1KB
SHA256 e25a7fa07a6974f8af7b10adeddddabe36e72757140a21170cfd4ed1c1b786b2
MD5 cc4fcb9909ac477ca1c205951a12d172
SHA1 600056ac08a3bd0c76345af575ea2b8d5c8a2b2a
SHA512 b6aaf06ec760967c784ee0d073b23b58df7db77746d4f20bfa8b3276b42193978a2dcd35fed16013803a51b25475ab54c56b8b238df2a373841e3720cf42b8e2
TLSH
T1CF21360563F9470AF0774732A9FA132B9628FDA4DFB293AF8580026C2C51514EEB0E72
MD5 SHA1 SHA512 TLSH

Submit Download

RES878A.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES878A.tmp
Size 1KB
SHA256 8119b6af17615ff1be6a45fd05f54ce837befd1eb0e9b293488fbfb45ea2a08d
MD5 205e95971e1dfbf3aa0c23bba2daa81a
SHA1 534d5c5977ce15c5d9c37dd6adc3d9f157ae5476
SHA512 eb984068e62ac5dd00c0284f079aadc0631d783f073a29b8f4f7f94a5dae779753cd219901007568540dd88dab1ab1af38c528ddb26696d566a752ce875f0dc1
TLSH
T1DB215C0553E8470EF0730732A9F6572B9629FD94DFB2935F8540422C2C61910EEB1E73
MD5 SHA1 SHA512 TLSH

Submit Download

RES8A2A.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES8A2A.tmp
Size 1KB
SHA256 e22f54d66ef74e358174190b8258f8b13990af93957984ac50777ab2e050943a
MD5 1e249759de5347e3cf25b291257379e3
SHA1 ebd9d6969acf5a32d816ac1aa65a48802287e0c7
SHA512 c36f0924651869d95c6281a3eb85f8cf936455d3795a95bcfcc561243a77c06d7dc7b5c07704b4918d96f1aacfb8b266695ecefc178127f3e3e8c68eba9ca658
TLSH
T13421500553E9470EF4B7473169F5136B9234FD64EFB2936F849443291C51144EEB0E72
MD5 SHA1 SHA512 TLSH

Submit Download

RES8CAB.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES8CAB.tmp
Size 1KB
SHA256 8af29ebab55eb32848845b63f56ecebd9b2739486fc11f5b6c207c05a18b915d
MD5 e77a2472ff1743a4834d581b8d9cd5a6
SHA1 3c992233d1a4e591d25a2e7adb006abddbef4451
SHA512 43943619012611f8b94d292cde3c43b126104a16e33346f2d35a579a2abf1d67afae74ad2ac20cf044b57b9db7699bd56f973eb08d81d0ecb730c881fb6646d6
TLSH
T121219C0653E8470FF0734732A9F6172BA625FD90DFB2935B848002292C51154EEA0E72
MD5 SHA1 SHA512 TLSH

Submit Download

RES8EDD.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES8EDD.tmp
Size 1KB
SHA256 d712da3ad259bc631a9334d5c3bb75fb635861b4b539ed52e8bd38c08205fee2
MD5 d311820c563a3abc1b8a7ba75c640e31
SHA1 ad87a557a1e0a6a547578ab21b6c8f612f195c00
SHA512 20bd1edd5f1d1d8e0d29620d337dabdfe9c22cdb88a89aeb915f23c0d8bd926f282822baf3e3391cce946f81c7c820b24742d9810a80177311b286fd159d79af
TLSH
T158213A0563E8470AF0774731B9F5132BA269FDA4DFB2E35FD580422C2C91544EEB1A72
MD5 SHA1 SHA512 TLSH

Submit Download

RES918D.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES918D.tmp
Size 1KB
SHA256 0044efb2c377b42f2d2c086c2e99e495af1cedc7322aad945009ca4943b44dd0
MD5 1e28c7a54297dfe6aa9008bbc7d6738c
SHA1 8fce67b9f71ff8e70a7176650ab90180973ca5b7
SHA512 ba67471be7d868f8edb114297677a3356922f3fe32310e38bc68e824b937ef9b6374e72e8d930bbe7b72d9a2f10296e65eec28d693d48ff61a69705e5ea48aae
TLSH
T175215C4553E8470EF0B74732A9FA172BA735FEA4DFB2535F844012292CA1154EE71E72
MD5 SHA1 SHA512 TLSH

Submit Download

RES93B0.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES93B0.tmp
Size 1KB
SHA256 9333790ac50be5b044cc1010ee0e1ced5c87b999f69bf28c6b99bdbfe7a9a4fc
MD5 3e788bfa76054a8d12c21f03e8dd8d57
SHA1 eb0b232b4025e1b4a29be26bf076677399f92a78
SHA512 eb612b6a933f65b407350d891e16e419511c5aba0527d79821889130cfc9a387a702daa1bc04ddd77df322fe0ef9c7330faca6697b41759bdc86f748d05a0ce3
TLSH
T1EB21760653E8070EF0B30732AAFA132BA634FDA5CFB2976E8480026C1C51544EEA0A72
MD5 SHA1 SHA512 TLSH

Submit Download

RES96CC.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES96CC.tmp
Size 1KB
SHA256 021d37e561da2394218226dae57e9ea6f85c3bebc6d0dcdabb2d42ed6b1e7803
MD5 f5d86c058aa78278120a4e3e77887914
SHA1 4578357524f60fa856972b37185a9e2226aa9490
SHA512 acf360c9f1eea9c25d2a2e3bf6b54e214586fa73aff5daf70e3fafb69cec5f149ba53eb2b13b96bb882c6aef310021a211fb5b66023b07903659434a39b21337
TLSH
T1AF213A0553E8470EF0770B32A9F6532B9664FDA4DFB6935B858042291C51544EEB0E72
MD5 SHA1 SHA512 TLSH

Submit Download

RES993D.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES993D.tmp
Size 1KB
SHA256 2ff02031e930f250a77c53bbadb182b95b6e5a7271c071ffbf0d497bcc16fbfd
MD5 73b7f32fce28352af36467305eea9732
SHA1 6fd2af555b5cc9814b0f5671827c2372aa5f13ce
SHA512 33422336e6b3484bdb981edab2f3352c3f114f045ebba09a6a1c1352767010796ca47d0c84db21240e1621a64a0ee17c415d40481d2de3a958e440effcff6d26
TLSH
T1D6213A0553E8470EF0774732A9FA172B9235FDA1DFB2A76B8540036D2C51144EEA1E76
MD5 SHA1 SHA512 TLSH

Submit Download

bxsiibfd.cmdline

Path C:\Users\Admin\AppData\Local\Temp\bxsiibfd.cmdline
Size 138B
SHA256 ee15634097c1e481719df81cb9951bb94c330548c0a94ffb1c41ee9a35e40949
MD5 c63b215cc8613ae413285d43ded58920
SHA1 a2597b161b1776ba476f58dae028b7546106e7a9
SHA512 bca47a69f11ecb1c341e4f0ea4c0ec764c1bf2dfcdc967d7bae13d16ecd4e753631b23448271eb38cd73197de081e4bbb962bd898c181fb5d6afa233d8eb1749
TLSH
T16FC09B014687C66925DD541F57F551DDC1B1DD097E593F144E50C46D1253409B786345
MD5 SHA1 SHA512 TLSH

Submit Download

bxsiibfd.dll

Path C:\Users\Admin\AppData\Local\Temp\bxsiibfd.dll
Size 1.6MB
SHA256 9bee6b2ea025b01c040da381e614e69fb51bd0b792c59321e2beb60ca609fe99
MD5 a461deffea08c166f2d254a25363247f
SHA1 7c98ee6a211b6b524132ba3094212bcf0b58d027
SHA512 7ae106fb03bfd49d54669646623cc51b278fbbd9134846a5e0c63151247b70a98901f0a78be9a325f97ef4eb11f9b6daffa9f34b572f91ae8eec4f749d36fe4b
SSDEEP 24576:O1fuQj+YSWPKPa73BaByndTPB3vkM62h7ox08l6h9Jl8+w8q8fP1kv:O1fuQoWPP73BPZl7JVly8Rn1c
TLSH
T18485F8342DEA102AF173AFBD9BE475AAE91EBBA33707586D1072038A4713942DDC153D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3rqt-zs.dll

Path C:\Users\Admin\AppData\Local\Temp\d3rqt-zs.dll
Size 1.6MB
SHA256 28c34354b0e8e42e72f58245eb783ee9b4f9c8aa5654674dab59f1ebc90f8f79
MD5 30d58e86f6bc204fb246d9492808328c
SHA1 c8587d8234e698e5a99d94f3eb022292721b7116
SHA512 39000ac92ffc6a05336ec9e4e54018fca8876883bf6dc2b31f1ba9f35134d86732773e9a7e394b5eedbbd295d32a1f3d50b156222479766c7c627acbefb1b20e
SSDEEP 24576:p1fuQj+YSWPKPa73BaByndTPB3vkM62h7ox08l6h9Jl8+w8q8fP1kv:p1fuQoWPP73BPZl7JVly8Rn1c
TLSH
T1C285F8342DEA102AF173AFBD9BE475AAE91EBBA33707586D1072038A4713942DDC153D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dphetxcp.cmdline

Path C:\Users\Admin\AppData\Local\Temp\dphetxcp.cmdline
Size 138B
SHA256 a1bce075d298e6257825d014b73bfe74c75b9746e418165d93d566736422c5d3
MD5 f49f12e16963c54a5a9a27db2495e501
SHA1 ec0668bbf937068c76ee53639a44e07e1901eb78
SHA512 e59f5e74a85dba1779c54f0a03a4027eddb92d0ac3209b381516e7b5e966fc649b49ec6e9f64fb5029c6af7fa8aaaa9e541f87ef8c80b744ba6947a8b49a0e3c
TLSH
T1C5C09B11429FC71E1DD5507B55F5519CC1F55E093E573F104650C55D16434DDBE92701
MD5 SHA1 SHA512 TLSH

Submit Download

dphetxcp.dll

Path C:\Users\Admin\AppData\Local\Temp\dphetxcp.dll
Size 1.6MB
SHA256 6e1d366aeacb5b8d9a7f221f4768674619b65c27ce932886401b23b0f123cb1c
MD5 6c41566986fdd23bc94b602fd15c382e
SHA1 524e5b4f345debf006b4414547cb8ac372cb8e86
SHA512 7d063c50650cf71c9a34364e8027dfad21ceb0873d095eef31837246f07a40a56f3e1db5bff1c1839bd33938611081480e588480764031342afb13044937e62b
SSDEEP 24576:H1fuQj+YSWPKPa73BaByndTPB3vkM62h7ox08l6h9Jl8+w8q8fP1kv:H1fuQoWPP73BPZl7JVly8Rn1c
TLSH
T1F485F8342DEA102AF173AFBD9BE475AAE91EBBA33707586D1072038A4713942DDC153D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fa7sctau.cmdline

Path C:\Users\Admin\AppData\Local\Temp\fa7sctau.cmdline
Size 138B
SHA256 89a528fd9038ccae5932082fec10bed354fee691c03957ff69382181d7ef2e74
MD5 5222de7e0493d9eec27aa6d77b2c9216
SHA1 41f38eb0da61dfe686c6016f77673ceabd5ca76b
SHA512 632ca5d3f286122369bc24696f3765bb9704b3d362bc66f0355a7b22286ee381736af194b9d29807460bdcf5d6893ae702e350c87ba406a1e0a2a0888ba043ae
TLSH
T196C09B414687C71915D5741B6DF5519C81B15D193E863F104650C55D725340DB6C6701
MD5 SHA1 SHA512 TLSH

Submit Download

fa7sctau.dll

Path C:\Users\Admin\AppData\Local\Temp\fa7sctau.dll
Size 1.6MB
SHA256 b3392e0c1cccfd02ffe6d62d16914d202e6bea9da839bbc746513ad22160b0b0
MD5 507eb053c535acce3d9d43e93beb53a3
SHA1 5081eb9e723b063879020a77d257d6de7b2a5e7a
SHA512 51ff904b00b30698c18bcb923f3569b9f95e6c9d6b8a08f8b458fbf987ffdcafbb10cff329594834994358a6c08751390434ce000f3810e6e3164c396dc97615
SSDEEP 24576:01fuQj+YSWPKPa73BaByndTPB3vkM62h7ox08l6h9Jl8+w8q8fP1kv:01fuQoWPP73BPZl7JVly8Rn1c
TLSH
T14885F8342DEA102AF173AFBD9BE475AAE91EBBA33707586D1072038A4713942DDC153D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fafka6fg.cmdline

Path C:\Users\Admin\AppData\Local\Temp\fafka6fg.cmdline
Size 138B
SHA256 a38c363762bee290a9d7845ce27fda24e4d03a606dfad5d4c67553abb2a4027c
MD5 9a1ab70d902ebeccf06128f6a5b0030f
SHA1 bd81db42f735287d5fc9a38542f13e7354dafd29
SHA512 675a598742b1ee27d6846dc534049d02fc944feb44d582a111dd9e8ae5e825af243b92291d00920a97870fe10452afe2ea6d5054547e8f5aeb7171eb710702c1
TLSH
T151C09B114287C61915C5701B55F571BC90B1ED093F893F104650C55F1243419B6C2301
MD5 SHA1 SHA512 TLSH

Submit Download

fafka6fg.dll

Path C:\Users\Admin\AppData\Local\Temp\fafka6fg.dll
Size 1.6MB
SHA256 fb19a4aeb0317fcc096dfcf7de6320b57b9e25ff395f36d4f97da2e62a5cbfb7
MD5 7e114ea20092e746a3f806f7245cb5d6
SHA1 d211135fafc1ec4388486a5029b9856b29546a5d
SHA512 e2ee74bc88073c7ba893966c83bd4ecaffde533a2dec8ff096e23747e4d879cdd84ca4d617dd98fa29d42ba2cc16c72a4d129cead104a2dcc40e0757deacdd44
SSDEEP 24576:C1fuQj+YSWPKPa73BaByndTPB3vkM62h7ox08l6h9Jl8+w8q8fP1kv:C1fuQoWPP73BPZl7JVly8Rn1c
TLSH
T17B85F8342DEA102AF173AFBD9BE475AAE91EBBA33707586D1072038A4713942DDC153D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

h-n7v8gp.cmdline

Path C:\Users\Admin\AppData\Local\Temp\h-n7v8gp.cmdline
Size 138B
SHA256 64f445c5cd0c96368f546cfe693ff43cc8f85c45b6fca638d327f06835835811
MD5 6b262c68ea8b35c5eceb790490aa177b
SHA1 0223bb7b5b3a84d3ad00d2ad0fd9effe2cb507b7
SHA512 ee4f7777a30da0d28126bfb11a5da566a429dba4f97fce2a64ba5c28c965f967712d98ed6f96d2b60e49ce3a955267793cdd68073df5863dd4ca3e960f3dc56f
TLSH
T1C9C09B015287D63D25D5F07B5DF6719C80F56D0B3E463F114651C65D5353449B7CA305
MD5 SHA1 SHA512 TLSH

Submit Download

h-n7v8gp.dll

Path C:\Users\Admin\AppData\Local\Temp\h-n7v8gp.dll
Size 1.6MB
SHA256 e5f5b786d16fb77334b7cba660d3f43b871be5cd75963cd416281b48829eabf2
MD5 173a94fe4d2df9f3f735cb22401a9639
SHA1 d35cffeb78c288a1a9e5545736e524419b43f890
SHA512 a9f7f7624fd91f9d78e7073da24e4eb331578e21a224623922cfb2b4e9489e41aff6dc68fb1afd9cd15b054832244c64607f79d1327bdcd41fad3e0246ada478
SSDEEP 24576:Q1fuQj+YSWPKPa73BaByndTPB3vkM62h7ox08l6h9Jl8+w8q8fP1kv:Q1fuQoWPP73BPZl7JVly8Rn1c
TLSH
T15F85F8342DEA102AF173AFBD9BE475AAE91EBBA33707586D1072038A4713942DDC153D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jtxknv53.cmdline

Path C:\Users\Admin\AppData\Local\Temp\jtxknv53.cmdline
Size 138B
SHA256 dd8dfd2e99fd2a944dd9a57e2dc102528ebf07e7c5451149563f2e743e497750
MD5 4de5fcc9fd2ff73018777689bfac4617
SHA1 7b66f9334364f1fd8ee0cbeec13e4dbcfe1b644d
SHA512 79e00a247c497d1c9ecd7afaa85def5070331ed5c30f3779bb378188cc788077b68580ffe4272fc9337afbb795f8d70a637cad510accfeef288997262bb00398
TLSH
T111C09B015387C61925C5905F55F5559CC2B5DD0F3F4B3F50B6A0CCDF5243409B683301
MD5 SHA1 SHA512 TLSH

Submit Download

jtxknv53.dll

Path C:\Users\Admin\AppData\Local\Temp\jtxknv53.dll
Size 1.6MB
SHA256 1c09597c2c1494e5a44e22017ab15e17daa5351515d5af3630edc18f3e48f4b5
MD5 7b0d5beb902ed81416a586d7f3e7f06b
SHA1 b2c50efa88412a83d9e0bd323432f3592c4f7f31
SHA512 1ea54d90e4c803fe0cc031ef2a0620307831783407349f0d2518e2f309f2d9a35c2fc5905aa4ed44006a9853fd518a6a2a1676b8925d49195f0eac6f56b29c1b
SSDEEP 24576:K1fuQj+YSWPKPa73BaByndTPB3vkM62h7ox08l6h9Jl8+w8q8fP1kv:K1fuQoWPP73BPZl7JVly8Rn1c
TLSH
T15D85F8342DEA102AF173AFBD9BE475AAE91EBBA33707586D1072038A4713942DDC153D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

np87aspe.dll

Path C:\Users\Admin\AppData\Local\Temp\np87aspe.dll
Size 1.6MB
SHA256 8f54d13f86774da1233bcc4614d4a113fb811eb4a9d1ccf5fff22ea9d281ca2a
MD5 be7f120368851cf96ee1e9827d2b2138
SHA1 ac000f27395606252225f5285cc404ca63d2429e
SHA512 1d9893fd7d9cb86cd731cec8f4524fa3e38e28587c0aa388cd24576065bd3b3a36339dec18c79546d6bc141ab24d1e3d5a28cbfaf0447b6db41e99237a125002
SSDEEP 24576:O1fuQj+YSWPKPa73BaByndTPB3vkM62h7ox08l6h9Jl8+w8q8fP1kv:O1fuQoWPP73BPZl7JVly8Rn1c
TLSH
T18885F8342DEA102AF173AFBD9BE475AAE91EBBA33707586D1072038A4713942DDC153D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nzimlwei.cmdline

Path C:\Users\Admin\AppData\Local\Temp\nzimlwei.cmdline
Size 138B
SHA256 bbe6e7102b43d897c4982bdb695a5d258bb78fc6db80ab5a5338e6d77e376d8c
MD5 bde81fb3dde61cdc0dafca6b890e9abe
SHA1 19d42f103c967a293a852ec1154451a37ef06612
SHA512 0a66265a8b9b0282fdf3c0a4e6df529d06134a24d0b5e29d0aa06a337172eb7a42a5ad5023e35060ac36453a45f6dbcae25ccb143aec2059734ea301c8e0cb79
TLSH
T138C09B0142C7C63915DF511F75F7519C80F15D093E553F544A50D4FD128341DBA82341
MD5 SHA1 SHA512 TLSH

Submit Download

nzimlwei.dll

Path C:\Users\Admin\AppData\Local\Temp\nzimlwei.dll
Size 1.6MB
SHA256 3b61eb30555a1188095aa3c54d757d1665edb3292bc7763619bfac602a086e78
MD5 7d8acf88c28bb78c677cf9b232622068
SHA1 02e25eea327320581964201a07f9bf0f10d20649
SHA512 103a3fd741cf57ec96b6ab1acdd779b7e8dc66907c21fc6bc78fc4391a7838bf85dcfcc9a666303095c8538f85337d0c19d1f5bec1becd96243b5b10b0ff573f
SSDEEP 24576:h1fuQj+YSWPKPa73BaByndTPB3vkM62h7ox08l6h9Jl8+w8q8fP1kv:h1fuQoWPP73BPZl7JVly8Rn1c
TLSH
T1DF85F8342DEA102AF173AFBD9BE475AAE91EBBA33707586D1072038A4713942DDC153D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scsvqla8.cmdline

Path C:\Users\Admin\AppData\Local\Temp\scsvqla8.cmdline
Size 138B
SHA256 c4b6bdd4a7742230065cedde7ccede8e60a323a3ff0a0ae60540e5a773c49c93
MD5 caefe17d18fca1e4b1bbca81cee8e691
SHA1 56693450c844f77f0b0f2de3398b32d1967cfb89
SHA512 24a267b31b05f5945258c8c47724b1e366ce39c725b4cf1b4222488810ac80060ac8ba07ae224a92e7c377b4e2b5b781674071b757e380705ed7f74f3db34242
TLSH
T160C09B054287CA5926C5513B55F551DC80B5DD093E473F707659C45D624351AF796301
MD5 SHA1 SHA512 TLSH

Submit Download

scsvqla8.dll

Path C:\Users\Admin\AppData\Local\Temp\scsvqla8.dll
Size 1.6MB
SHA256 93ea0c33abc32d355d881d791f6e6ddb1f8b330ad63aba93c8bac5ac644e649a
MD5 7614f1b7ce4965510cb1d9e1e70ce231
SHA1 2b85ea50555f05d813b0d098037e96ad05dd5c36
SHA512 51e4fc24c8e5827dcae45ac765e1e17ede1be8a30c39641ada01840243db74a4f1b5401ad10af0b3de8fe3c94604398e6a8ef00ce86b968f66303570dbaa1fd5
SSDEEP 24576:d1fuQj+YSWPKPa73BaByndTPB3vkM62h7ox08l6h9Jl8+w8q8fP1kv:d1fuQoWPP73BPZl7JVly8Rn1c
TLSH
T10885F8342DEA102AF173AFBD9BE475AAE91EBBA33707586D1072038A4713942DDC153D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thvb12uj.cmdline

Path C:\Users\Admin\AppData\Local\Temp\thvb12uj.cmdline
Size 138B
SHA256 932dd4333d7366393195dc0698682e7a237e581aae02291e8cd81019788235f8
MD5 198768e10d9a171be577c620aef3be99
SHA1 bb9a164846070a4ac3f51b3e991fb219320be7bd
SHA512 0f2be31ff89d176907b8a4d12121259f182bad220f52ec369be83df55a58b6baee5211efda83a0c19c934a2c2c79d1b3288a921bd21e76d5be89b2e0b0d4fbfe
TLSH
T1C5C09B0543C7C61915CD511F95FD529C81B35D5A3F753F104760C4AD125340BBEA3301
MD5 SHA1 SHA512 TLSH

Submit Download

thvb12uj.dll

Path C:\Users\Admin\AppData\Local\Temp\thvb12uj.dll
Size 1.6MB
SHA256 7b7bda1157481d622af4c18d245c5b701b7dbfc8956afa27e4e70eef583b46db
MD5 b30eccecdcac8b3c3a4433995a636174
SHA1 3d87837c5f522ec0df1af748d73b4a98cb32171f
SHA512 a28e56f42ec9ad2f16362efd52720a1ca2268be428f1f2dfc79e7c4469ad0b7292499e56a4e8f25ef3caebd5a61caaab1a846f2f42f975b55f0a01d0fd985671
SSDEEP 24576:V1fuQj+YSWPKPa73BaByndTPB3vkM62h7ox08l6h9Jl8+w8q8fP1kv:V1fuQoWPP73BPZl7JVly8Rn1c
TLSH
T1CF85F8342DEA102AF173AFBD9BE475AAE91EBBA33707586D1072038A4713942DDC153D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

u_mcfbrc.0.vb

Path C:\Users\Admin\AppData\Local\Temp\u_mcfbrc.0.vb
Size 829KB
SHA256 3d18afa77efeef0367ca8677d1a286ecfe2aa55dcc4b54d3cf156ff3bc60bdc1
MD5 0ef3b6f6f068f5c28f21d555494201b6
SHA1 894045317dae93130b791121479f1379fa91b316
SHA512 9fc01cc152b4a00b746c65cb2506cd4d2ef34a6afb59464c0e8fcd62ba027826af84e3b16ebbf811e3cc689c10500e387c89d3e8723e3bcfcfefbb2c4783acb9
SSDEEP 12288:uUc8/90IbsvVuUlf+clnpWmzb9/4xAglnz+KWUjT7fq4y4olO+/8i6yGpnth:ukQNuKIAgpzfWUO1J/8iLUnth
TLSH
T1150523304952982D0ADD0A0A10FE6E2B5CF85DC7A8D4F1F4F25D39E9A7B47B0A0BD6D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

u_mcfbrc.cmdline

Path C:\Users\Admin\AppData\Local\Temp\u_mcfbrc.cmdline
Size 138B
SHA256 adc0742dab8ce0199bb38692313b54d1db6a65f13ce61434b6de8039b946d2f0
MD5 1230fdc898c0ed9021c0b4114af80268
SHA1 87c82f383ad12a0b1f70dab65aaa1577d66a48c8
SHA512 e504a8345da8e7a28ec06c3519c00d8baff927a4ebc2a55aab12de034b9ed553a0b6bc39df9d28d1a4ac8e71929de9c258bceb358067f6b8b1d286f968dec2ea
TLSH
T11FC09B4143C7C65A1DC5541B65F6E2DC81F15D197E493F104678C45D134340BB682391
MD5 SHA1 SHA512 TLSH

Submit Download

u_mcfbrc.dll

Path C:\Users\Admin\AppData\Local\Temp\u_mcfbrc.dll
Size 1.6MB
SHA256 ad9678be648e21cfbe932294551b6b1f3dedd4c1f77899187dae73c5ebfb97e3
MD5 140d3b9e3360bf316f7d7243a49fe966
SHA1 20b4944675040aa1b6506116b2d88aebb0e136c7
SHA512 fe0d9c6faa485117a29087a95270470c9ce37dbeb10a7b4fab72b6bad7402267e9640b8a191daf730dee37544ffb940b427a1d466668ebf4d570acb9694e46de
SSDEEP 24576:X1fuQj+YSWPKPa73BaByndTPB3vkM62h7ox08l6h9Jl8+w8q8fP1kv:X1fuQoWPP73BPZl7JVly8Rn1c
TLSH
T16685F8342DEA102AF173AFBD9BE475AAE91EBBA33707586D1072038A4713942DDC153D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uq3o8qmo.cmdline

Path C:\Users\Admin\AppData\Local\Temp\uq3o8qmo.cmdline
Size 138B
SHA256 28ed08419a47af2215cac345fc59035cb7034034276cdc39e9d5cd1bc7eb07d6
MD5 380c8bed0e547861dc0030fe6ea932d8
SHA1 29255bae2f0496b375877b137944905254012bb7
SHA512 d16f946fa0d839b4be8f08f16ddcbb7068a6df7f4164226b967266fa213bda5ff5eee3c33fe0a9d647116e40d4c793d6043d0d799acab40febc202a48562ff7f
TLSH
T175C09B4142D7DA5E15C5501FD5F555DC90B19D0D3E473F244665DCDF3243509B682311
MD5 SHA1 SHA512 TLSH

Submit Download

vbc109BCB13978C4F75992F528C615BB6D.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbc109BCB13978C4F75992F528C615BB6D.TMP
Size 652B
SHA256 11a71e1ca7d39ee4609663520a3fb10bd344e54c2ee06173ca7d68870901a67c
MD5 c69f64118f45fcf15053c7030bede553
SHA1 ce171f2d5026af2f757be1bf11d628c66985b86a
SHA512 08dcf055c4ddc040c34c8a54794cd9706e6459c59eacfe1ad63ed98f5c28e3e11cd6b35b0c09e3008c7e58d70fc600738a82fef9ed846fe8d5782db6be564dc1
TLSH
T1A9F05E0963F8420EF0F34F70BDF6436395A8BC64DE7293ED599007192864910C972FB2
MD5 SHA1 SHA512 TLSH

Submit Download

vbc34D4FC254DD04B4691F197CB713619D5.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbc34D4FC254DD04B4691F197CB713619D5.TMP
Size 652B
SHA256 9df610e349238d952aad4c2fcdf3ffff2b752d34f97a4cc7d504ba85931a4f00
MD5 ddfdb469c0bf06cd070e516e4e7d435d
SHA1 6d04698c2baef65d0707ee99ae47621dbb7a7067
SHA512 5b8ffd1272e15a314ad70ec97f897ce3421ca56fe0273afaefa6f2bfba00c2eb3b8cf4a12296e79008a9a58d8ee0cb9567b1d7f287cf94f7aac8c59464fa9bda
TLSH
T12BF0540A63F8020EF0F39B30BDF543B791A9BC65DE32D3ED6480431D58645149A61F71
MD5 SHA1 SHA512 TLSH

Submit Download

vbc57A20DA0C60145A6AD62DD3DA7B080F2.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbc57A20DA0C60145A6AD62DD3DA7B080F2.TMP
Size 652B
SHA256 57bfdb23eec5a24788a437f49deda066b19a757533930792728acffe2b97d1f5
MD5 4dd0f3593277a35bd278ae3f1dd0c138
SHA1 0cd712fa67ffcf15ce4dec89c986bb82d0d3cd3c
SHA512 e3ea8f040144bf04fa25705d9acc2e6a1bfa6834f59ba93fe597e82223c34df3d0c798b9161a6c6f1de9baa36caaff64172ee2fe33840a90ccd9c56298f2e646
TLSH
T187F03A0973F8120AF0F75B30B9FA836395ACBC64DE3293ED2544035D2C64A248962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

vbc57F2035AEB46410889842710F72530F5.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbc57F2035AEB46410889842710F72530F5.TMP
Size 652B
SHA256 a0fc36bd9862e48b4839080ddec43acdf1d521ec16af2a16f35b9d903119a7f1
MD5 8de50130196daeb71547e69453f87ab3
SHA1 4ee70f687652aa4fa7ac40ab19cbbf805820ffbc
SHA512 afa2545e5d925dbb196fa67fd3dc7187eab388fd6958011f9d3e684df79a08b2d3b98d5b61a6a43d2a3a22ce8c511855ec5d823de2acf41f4ec84135aaba32cc
TLSH
T172F05E0963F8460EF0F34F30BEF6536391B9BD65DE3297EE144003292C645109962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

vbc67B0040F580D470AABE2F6B46A45CC4.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbc67B0040F580D470AABE2F6B46A45CC4.TMP
Size 652B
SHA256 f05368e8736612a18267758e72b5a4bc41959025751766ada854ee8602d110a5
MD5 4d5e46fc47de667993abf5664007de5d
SHA1 2abfb88073829427de4b88e37b7e0899527f0959
SHA512 9f27b363f7fa3a27a43b6d631c09a66a2825b0c16d81daddc7b4610ad42dd8432e9fa4bcc36d37fdfdad620be31e5e4ba0e0b29b4c83ba98b0ec80d940acb6fd
TLSH
T1DCF05E19A3F8060EF0F34B30BDF6436391A9FCA4DE32D3ED1544031928685148AA2FB2
MD5 SHA1 SHA512 TLSH

Submit Download

vbc6F5D89891E4847E5B7C36E8892C53861.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbc6F5D89891E4847E5B7C36E8892C53861.TMP
Size 652B
SHA256 a854d417ba9ebaf049d78fb5a85cc9c8f543d047ce59b0661b84526c1f070794
MD5 7f6d63ae897bd7640b635a50f30a39f0
SHA1 650b58148e5b2ccc2bc6fb478598b802347b61ab
SHA512 3c1f9e1ffbe41b7b25264b0248f29aa8055b93df1824d57cb97b9b661ac1d5089c2edb2a96a3b9140a48c859c1bab1ae08141171a9e651ace1421fcf3e9acebc
TLSH
T1FDF05E0A63F8520EF4F34B30BDF643A391A8BC65EE3293ED185403192C646148972FB2
MD5 SHA1 SHA512 TLSH

Submit Download

vbc72463EAC51B4401BADBBF7274C5664E9.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbc72463EAC51B4401BADBBF7274C5664E9.TMP
Size 652B
SHA256 7aa22e245791fc8cd3c67a093535d32981c16afb83f12e48c171778e32c04de4
MD5 d68e523f25ef2cf4ebd3d342aa6d5455
SHA1 fce2a1a21ffc5242e3ef6e9b8c9a073ddb0b624d
SHA512 1933fdd4dc748b6c78640ea05747f833668509e6f4512ebbc10592f72ba84123146f2878f0d2acfb9ee094e2319494f2984fd7cf76d679e28d22997b66c6e638
TLSH
T148F05E0963F8020EF0F34F31FDF69363A1A8BC64DE72A3ED1440031D28645208962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

vbc8366A6EC437048FAB5415836483BEB3.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbc8366A6EC437048FAB5415836483BEB3.TMP
Size 652B
SHA256 34769fc232374c59f11765d0e1f2aab108413d3f1050a1af5c577006a7866e73
MD5 39b9625a385a4130ac1e42f002626c3c
SHA1 78525eb5ce416789b2c864d2bc6b12fc5b28102f
SHA512 992a43142c559b935b240355e71e8f8b3717a2fbd3190ce79c2b4de5759de6e435c9def014651b96caad9358d3f7dddcddab341fe4971991f462ba33993ccba3
TLSH
T1D5F05E4963F8020EF0F34B71BDF64363A1A9FC64DE3393ED1440032928645108962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

vbcAC5ADF706DFB4E2D98620DD88F5F776.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbcAC5ADF706DFB4E2D98620DD88F5F776.TMP
Size 652B
SHA256 d3ed051372aba5d301a4ced66f8d1842591a8695f515947e8e516a19a6397626
MD5 399449c2b86c8e73e3fcc05a28611ccb
SHA1 5860b6a82cdabd4840afe6bc8314a6855232f950
SHA512 97856ab7d006087c2187450ba888745dfbc24323459e01757692c33a07b14fc2ff98ad8170fc7feb1c1b32ccfe8a546b7bf0c7ec2d1786dca1bc11b2609cbfd8
TLSH
T100F05E09A3F8020EF0F34B30BDF6536395A9BC65DE3293ED1840431D2874A108972FB2
MD5 SHA1 SHA512 TLSH

Submit Download

vbcAE2031BEEC74AD8A9FBAB94ACB520D2.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbcAE2031BEEC74AD8A9FBAB94ACB520D2.TMP
Size 652B
SHA256 a971b0e1823be3b945ba2d85b9474068f7444a198e4079aa215a3d0be625828c
MD5 881332f6b9591c6815bd90f321f55410
SHA1 6a38234f32dbff2e40101a98dd74bd52424a83c3
SHA512 0663ff6e3bb560781d8d96299fbd8e9ba7cc600f08f854b8e1c13178854f9717d3313ba047d864124a07331b64bdaec8106a5137245ad6345bdbd8480d37a8a8
TLSH
T160F08209A3F8020EF0F34B71BEF6436395A8BC64DE3293ED5484431D2C645109962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

vbcB8897C76D6F54B0AB04DD7CAD5A91FA2.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbcB8897C76D6F54B0AB04DD7CAD5A91FA2.TMP
Size 652B
SHA256 5210bc67b1dd163f8ee4e4fa4286b897c3d5ba772e56f3e72284c023c6ec5bed
MD5 e5c43934efe785152ae661733c7485d8
SHA1 83d400e7090570e30e3d65c8c0db976d707ebbdf
SHA512 0e82830eb7740a78a08c5f4beb1e0054272e150aaa3f68796e24e1fe231bc0c1f0c9551012c5de57739ed482f8415903afee061076829ea606a3e4df1cf71ba5
TLSH
T191F0820963F8020EF0F34B34FDF6476395A9BC65DE32A3ED6440035D2C655208962FB6
MD5 SHA1 SHA512 TLSH

Submit Download

vbcC42036A7D7EF4ED391F8FEDC41F43880.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbcC42036A7D7EF4ED391F8FEDC41F43880.TMP
Size 652B
SHA256 b2f4ff1fdc3ca002793887459aa50e1eff49f91e3ce0610e8d6027378f579509
MD5 34d21bbedc9ccbd8eef0b4accf132d5b
SHA1 10d023a3d04d15aa0891efe011193b4209e36886
SHA512 8bbaff244c90db16f47e73f0b30d372a285c4aa1ccc5f57a1b26ed938cb58b4e3905f8098d2fc6af385ce72bfc7a8a75a3a11000534b5ee64de0995bfb84e137
TLSH
T1ABF05E0963F8120EF0F34B71BDF6836399A8BC66DE3397ED2440035D28649148962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

vbcD1B0526D14E54D4CA2C37AB97F6FB98F.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbcD1B0526D14E54D4CA2C37AB97F6FB98F.TMP
Size 652B
SHA256 c7ed282b3aeff52931485aafc22cc4ee08ca9f27eae2b9da61b1808215151030
MD5 595725591c99199758334bdb24203c1c
SHA1 96e274e69262b08ae0cdb86afe184f24c6f2630f
SHA512 de02d075f56637127604d8c47c9e8a89ad451aee9d90d30f30f29654d6debef894254db8a40666f74dcad3c22ef4b983bb15bac5ec18d03317dfeba3125bb5dd
TLSH
T1CCF05E0963F8030EF0F74B31BEF643A795A9BC65DE72A3ED1544132928649108962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/312-587-0x000000001CC70000-0x000000001CE14000-memory.dmp

Download

memory/464-81-0x000000001CA70000-0x000000001CC14000-memory.dmp

Download

memory/636-650-0x000000001C740000-0x000000001C8E4000-memory.dmp

Download

memory/676-776-0x000000001C9F0000-0x000000001CB94000-memory.dmp

Download

memory/716-668-0x000000001C1F0000-0x000000001C394000-memory.dmp

Download

memory/924-605-0x000000001BD30000-0x000000001BED4000-memory.dmp

Download

memory/1232-272-0x000000001BD60000-0x000000001BF04000-memory.dmp

Download

memory/1236-659-0x000000001CAD0000-0x000000001CC74000-memory.dmp

Download

memory/1312-497-0x000000001BE60000-0x000000001C004000-memory.dmp

Download

memory/1356-596-0x000000001C160000-0x000000001C304000-memory.dmp

Download

memory/1432-151-0x000000001C8A0000-0x000000001CA44000-memory.dmp

Download

memory/1472-835-0x000000001C300000-0x000000001C4A4000-memory.dmp

Download

memory/1548-227-0x000000001CA30000-0x000000001CBD4000-memory.dmp

Download

memory/1556-515-0x000000001C3A0000-0x000000001C544000-memory.dmp

Download

memory/1712-245-0x000000001C920000-0x000000001CAC4000-memory.dmp

Download

memory/1892-533-0x000000001BF20000-0x000000001C0C4000-memory.dmp

Download

memory/1916-123-0x000000001BE30000-0x000000001BFD4000-memory.dmp

Download

memory/1928-380-0x000000001C3C0000-0x000000001C564000-memory.dmp

Download

memory/1948-317-0x000000001C460000-0x000000001C604000-memory.dmp

Download

memory/2032-767-0x000000001C970000-0x000000001CB14000-memory.dmp

Download

memory/2080-614-0x000000001C9C0000-0x000000001CB64000-memory.dmp

Download

memory/2104-236-0x000000001C1A0000-0x000000001C344000-memory.dmp

Download

memory/2152-632-0x000000001C5F0000-0x000000001C794000-memory.dmp

Download

memory/2264-344-0x000000001BF70000-0x000000001C114000-memory.dmp

Download

memory/2300-95-0x000000001CAC0000-0x000000001CC64000-memory.dmp

Download

memory/2392-434-0x000000001C630000-0x000000001C7D4000-memory.dmp

Download

memory/2480-826-0x000000001C680000-0x000000001C824000-memory.dmp

Download

memory/2588-308-0x000000001C250000-0x000000001C3F4000-memory.dmp

Download

memory/2724-67-0x000000001C640000-0x000000001C7E4000-memory.dmp

Download

memory/2744-263-0x000000001C050000-0x000000001C1F4000-memory.dmp

Download

memory/2784-808-0x000000001CA10000-0x000000001CBB4000-memory.dmp

Download

memory/2824-191-0x000000001BF20000-0x000000001C0C4000-memory.dmp

Download

memory/2832-398-0x000000001CA30000-0x000000001CBD4000-memory.dmp

Download

memory/2916-479-0x000000001CB80000-0x000000001CD24000-memory.dmp

Download

memory/2924-281-0x000000001C0F0000-0x000000001C294000-memory.dmp

Download

memory/3004-3-0x00007FFD14A90000-0x00007FFD15431000-memory.dmp

Download

memory/3004-2-0x000000001C0C0000-0x000000001C58E000-memory.dmp

Download

memory/3004-21-0x00007FFD14A90000-0x00007FFD15431000-memory.dmp

Download

memory/3004-22-0x00007FFD14A90000-0x00007FFD15431000-memory.dmp

Download

memory/3004-1-0x000000001BB40000-0x000000001BBE6000-memory.dmp

Download

memory/3004-19-0x000000001C7F0000-0x000000001C994000-memory.dmp

Download

memory/3004-5-0x00007FFD14A90000-0x00007FFD15431000-memory.dmp

Download

memory/3004-0-0x00007FFD14D45000-0x00007FFD14D46000-memory.dmp

Download

memory/3004-4-0x00007FFD14A90000-0x00007FFD15431000-memory.dmp

Download

memory/3024-299-0x000000001C010000-0x000000001C1B4000-memory.dmp

Download

memory/3032-844-0x000000001C910000-0x000000001CAB4000-memory.dmp

Download

memory/3096-179-0x000000001CC10000-0x000000001CDB4000-memory.dmp

Download

memory/3212-26-0x00007FFD14A90000-0x00007FFD15431000-memory.dmp

Download

memory/3212-37-0x000000001CB10000-0x000000001CCB4000-memory.dmp

Download

memory/3212-39-0x00007FFD14A90000-0x00007FFD15431000-memory.dmp

Download

memory/3344-677-0x000000001C780000-0x000000001C924000-memory.dmp

Download

memory/3372-407-0x000000001CAB0000-0x000000001CC54000-memory.dmp

Download

memory/3404-542-0x000000001C3F0000-0x000000001C594000-memory.dmp

Download

memory/3440-695-0x000000001BDC0000-0x000000001BF64000-memory.dmp

Download

memory/3516-731-0x000000001C100000-0x000000001C2A4000-memory.dmp

Download

memory/3532-53-0x000000001C3B0000-0x000000001C554000-memory.dmp

Download

memory/3548-290-0x000000001C200000-0x000000001C3A4000-memory.dmp

Download

memory/3572-623-0x000000001BF70000-0x000000001C114000-memory.dmp

Download

memory/3652-362-0x000000001CAC0000-0x000000001CC64000-memory.dmp

Download

memory/3668-425-0x000000001C310000-0x000000001C4B4000-memory.dmp

Download

memory/3728-524-0x000000001C000000-0x000000001C1A4000-memory.dmp

Download

memory/3780-713-0x000000001C530000-0x000000001C6D4000-memory.dmp

Download

memory/3824-799-0x000000001CA40000-0x000000001CBE4000-memory.dmp

Download

memory/3836-371-0x000000001C2D0000-0x000000001C474000-memory.dmp

Download

memory/3896-209-0x000000001C760000-0x000000001C904000-memory.dmp

Download

memory/4004-109-0x000000001BDC0000-0x000000001BF64000-memory.dmp

Download

memory/4032-578-0x000000001CC60000-0x000000001CE04000-memory.dmp

Download

memory/4072-353-0x000000001CB10000-0x000000001CCB4000-memory.dmp

Download

memory/4080-722-0x000000001C160000-0x000000001C304000-memory.dmp

Download

memory/4100-200-0x000000001C2C0000-0x000000001C464000-memory.dmp

Download

memory/4184-470-0x000000001C590000-0x000000001C734000-memory.dmp

Download

memory/4228-560-0x000000001C560000-0x000000001C704000-memory.dmp

Download

memory/4236-817-0x000000001C500000-0x000000001C6A4000-memory.dmp

Download

memory/4244-506-0x000000001BF50000-0x000000001C0F4000-memory.dmp

Download

memory/4260-137-0x000000001BFC0000-0x000000001C164000-memory.dmp

Download

memory/4276-461-0x000000001C030000-0x000000001C1D4000-memory.dmp

Download

memory/4288-641-0x000000001CC10000-0x000000001CDB4000-memory.dmp

Download

memory/4400-488-0x000000001C9A0000-0x000000001CB44000-memory.dmp

Download

memory/4404-569-0x000000001C8B0000-0x000000001CA54000-memory.dmp

Download

memory/4444-443-0x000000001C7F0000-0x000000001C994000-memory.dmp

Download

memory/4480-389-0x000000001C110000-0x000000001C2B4000-memory.dmp

Download

memory/4532-165-0x000000001BE40000-0x000000001BFE4000-memory.dmp

Download

memory/4536-686-0x000000001BD80000-0x000000001BF24000-memory.dmp

Download

memory/4604-254-0x000000001C790000-0x000000001C934000-memory.dmp

Download

memory/4704-758-0x000000001C780000-0x000000001C924000-memory.dmp

Download

memory/4764-551-0x000000001C690000-0x000000001C834000-memory.dmp

Download

memory/4816-218-0x000000001C610000-0x000000001C7B4000-memory.dmp

Download

memory/4856-335-0x000000001C6A0000-0x000000001C844000-memory.dmp

Download

memory/4876-452-0x000000001CBA0000-0x000000001CD44000-memory.dmp

Download

memory/4920-416-0x000000001C170000-0x000000001C314000-memory.dmp

Download

memory/4936-749-0x000000001CAA0000-0x000000001CC44000-memory.dmp

Download

memory/4956-326-0x000000001C5D0000-0x000000001C774000-memory.dmp

Download

memory/4960-740-0x000000001C690000-0x000000001C834000-memory.dmp

Download

memory/4972-785-0x000000001BD30000-0x000000001BED4000-memory.dmp

Download

memory/5012-790-0x000000001CAA0000-0x000000001CC44000-memory.dmp

Download

memory/5056-704-0x000000001BF70000-0x000000001C114000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads