e35a86b76025f4ae26fefa0b5f4e9ebbcb829781c3cf42f134a0f4df20c34912

Analysis

max time kernel
150s
max time network
129s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/10/2026, 15:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
Size 1.1MB
Sample261006-sdmc5azv8k
SHA256 e35a86b76025f4ae26fefa0b5f4e9ebbcb829781c3cf42f134a0f4df20c34912
MD5 249d459ffc75875988ca2ebf1587aead
SHA1 2f7c9edea440f4770a1796b0a95e047dd04b474f
SHA512 f5f648b9e52e7e62e7a057c2aa5652f1271e6216c78fdf2ade0cb6ced7cc7f1844c5830bde039d5eda0bc864b0e0cd35b394fc9bfc52d8b80da610937ff26743
SSDEEP 24576:yGEoUEoCPSNxRFzxGbp7acoouofC6Ivmj5WzD:eCCHzMa8W
TLSH
T1053523103FE1163FCE6CC77535FA7E0D5AE693A2684CC19A7DAC78C61B56B810423A6C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Uses the VBS compiler for execution 1 TTPs

Command and Scripting Interpreter
T1059

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2540 wrote to memory of 4908	2540	jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe	89
PID 4908 wrote to memory of 5164	4908	vbc.exe	91
PID 2540 wrote to memory of 3432	2540	jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe	92
PID 3432 wrote to memory of 5008	3432	jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe	93
PID 5008 wrote to memory of 4132	5008	vbc.exe	95
PID 3432 wrote to memory of 5740	3432	jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe	96
PID 5740 wrote to memory of 4956	5740	jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe	97
PID 4956 wrote to memory of 3180	4956	vbc.exe	99
PID 5740 wrote to memory of 1104	5740	jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe	100
PID 1104 wrote to memory of 5860	1104	jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe	101
PID 5860 wrote to memory of 4228	5860	vbc.exe	103
PID 1104 wrote to memory of 3484	1104	jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe	104
PID 3484 wrote to memory of 5784	3484	jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe	105
PID 5784 wrote to memory of 4600	5784	vbc.exe	107
PID 3484 wrote to memory of 5772	3484	jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe	108
PID 5772 wrote to memory of 6072	5772	jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe	109
PID 6072 wrote to memory of 5612	6072	vbc.exe	111
PID 5772 wrote to memory of 5168	5772	jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe	112
PID 5168 wrote to memory of 4996	5168	jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe	113
PID 4996 wrote to memory of 4748	4996	vbc.exe	115
PID 5168 wrote to memory of 4988	5168	jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe	116
PID 4988 wrote to memory of 2924	4988	jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe	117
PID 2924 wrote to memory of 2120	2924	vbc.exe	119
PID 4988 wrote to memory of 1688	4988	jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe	120
PID 1688 wrote to memory of 2100	1688	jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe	121
PID 2100 wrote to memory of 2728	2100	vbc.exe	123
PID 1688 wrote to memory of 1880	1688	jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe	124
PID 1880 wrote to memory of 2044	1880	jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe	125
PID 2044 wrote to memory of 4868	2044	vbc.exe	127
PID 1880 wrote to memory of 5156	1880	jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe	128
PID 5156 wrote to memory of 4192	5156	jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe	129
PID 4192 wrote to memory of 3368	4192	vbc.exe	131
PID 5156 wrote to memory of 1836	5156	jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe	132
PID 1836 wrote to memory of 2408	1836	jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe	133
PID 2408 wrote to memory of 5200	2408	vbc.exe	135
PID 1836 wrote to memory of 2516	1836	jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe	136
PID 2516 wrote to memory of 3436	2516	jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe	137
PID 3436 wrote to memory of 5660	3436	vbc.exe	139
PID 2516 wrote to memory of 1752	2516	jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe	140
PID 1752 wrote to memory of 5956	1752	jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe	141
PID 5956 wrote to memory of 3756	5956	vbc.exe	143
PID 1752 wrote to memory of 5580	1752	jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe	144
PID 5580 wrote to memory of 3988	5580	jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe	145
PID 3988 wrote to memory of 4224	3988	vbc.exe	147
PID 5580 wrote to memory of 3588	5580	jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe	148
PID 3588 wrote to memory of 4128	3588	jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe	149
PID 4128 wrote to memory of 1052	4128	vbc.exe	151
PID 3588 wrote to memory of 4760	3588	jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe	152
PID 4760 wrote to memory of 3464	4760	jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe	153
PID 3464 wrote to memory of 5012	3464	vbc.exe	155
PID 4760 wrote to memory of 4772	4760	jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe	156
PID 4772 wrote to memory of 4804	4772	jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe	157
PID 4804 wrote to memory of 2464	4804	vbc.exe	159
PID 4772 wrote to memory of 5960	4772	jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe	160
PID 5960 wrote to memory of 6000	5960	jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe	161
PID 6000 wrote to memory of 240	6000	vbc.exe	163
PID 5960 wrote to memory of 264	5960	jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe	164
PID 264 wrote to memory of 2780	264	jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe	165
PID 2780 wrote to memory of 5192	2780	vbc.exe	167
PID 264 wrote to memory of 3080	264	jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe	168
PID 3080 wrote to memory of 2900	3080	jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe	169
PID 2900 wrote to memory of 5128	2900	vbc.exe	171
PID 3080 wrote to memory of 5492	3080	jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe	172
PID 5492 wrote to memory of 1676	5492	jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe	173

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2540
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\aiidrsle.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4908
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1EC9.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcC8E63CC6B3E844219730F976F1FF45E4.TMP"
    3⤵
    PID:5164
- C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
  C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3432
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\iofyzdp_.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5008
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2503.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcD80D5913E2AD4C53814BA0ED3A6F9887.TMP"
      4⤵
      PID:4132
- - C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
    C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5740
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\iiyapacw.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4956
    - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES38BA.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc846B69E8BB64B0E8EAA48DCFF2EF2.TMP"
        5⤵
        
        PID:3180
  - - C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
      C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1104
    - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\eozurlap.cmdline"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:5860
      - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3C15.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc4A689AD28A4D4F8788FF841AC0CCA661.TMP"
        6⤵
        
        PID:4228
    - - C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3484
      - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ylgrobsd.cmdline"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:5784
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3EF3.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc90054E65801A4CB9BACF16F6BF3AA716.TMP"
        7⤵
        
        PID:4600
      - C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:5772
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\vzfjqmdx.cmdline"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:6072
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES41C2.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc330223E7C3834ECCAC5DA64CD32B596.TMP"
        8⤵
        
        PID:5612
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:5168
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\eimpaakc.cmdline"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:4996
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES452D.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc3D2A817223F949568A861B339CDCD66.TMP"
        9⤵
        
        PID:4748
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:4988
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\c8hq-qti.cmdline"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:2924
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES47EC.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcF86442D25DF4D018FEBB09F1155D881.TMP"
        10⤵
        
        PID:2120
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:1688
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\2qozwp-l.cmdline"
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:2100
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4ACB.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcBDEC1BDAF13C4066859D5BF16B1712EF.TMP"
        11⤵
        
        PID:2728
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:1880
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\2upjjuml.cmdline"
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:2044
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4CFD.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcA2E395402B1544C69F6087B543C8D5A.TMP"
        12⤵
        
        PID:4868
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:5156
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\vlig8ujt.cmdline"
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:4192
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4F7E.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc7859E112912C44ABBCF895347CB13E62.TMP"
        13⤵
        
        PID:3368
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:1836
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\lqgpfuwd.cmdline"
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:2408
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES51C0.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc1DC8BF2D8AA54779922BB419155F3685.TMP"
        14⤵
        
        PID:5200
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:2516
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\htlrzpq_.cmdline"
        14⤵
        Suspicious use of WriteProcessMemory
        
        PID:3436
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES54BD.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcF4598E736C3F4384ADC66EE793DD1FA8.TMP"
        15⤵
        
        PID:5660
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        14⤵
        Suspicious use of WriteProcessMemory
        
        PID:1752
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\zqid6snz.cmdline"
        15⤵
        Suspicious use of WriteProcessMemory
        
        PID:5956
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES56B1.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc22B801BF69E8482B96A4A1563659277.TMP"
        16⤵
        
        PID:3756
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        15⤵
        Suspicious use of WriteProcessMemory
        
        PID:5580
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\x-lo4niv.cmdline"
        16⤵
        Suspicious use of WriteProcessMemory
        
        PID:3988
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5838.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc8E618F37B5544C15AE52DA45D2B45A7B.TMP"
        17⤵
        
        PID:4224
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        16⤵
        Suspicious use of WriteProcessMemory
        
        PID:3588
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\x6lzwcma.cmdline"
        17⤵
        Suspicious use of WriteProcessMemory
        
        PID:4128
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES59EE.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc851EAA6EF4414E6AB3D24C1B815D934.TMP"
        18⤵
        
        PID:1052
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        17⤵
        Suspicious use of WriteProcessMemory
        
        PID:4760
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\vy8rphdv.cmdline"
        18⤵
        Suspicious use of WriteProcessMemory
        
        PID:3464
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5BE2.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc9DABA74BC22D42CAB5B2D11515E58E8F.TMP"
        19⤵
        
        PID:5012
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        18⤵
        Suspicious use of WriteProcessMemory
        
        PID:4772
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\lrpwlrjt.cmdline"
        19⤵
        Suspicious use of WriteProcessMemory
        
        PID:4804
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5DF5.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc3CA517EAE1004A6E8F70BDAB49223955.TMP"
        20⤵
        
        PID:2464
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        19⤵
        Suspicious use of WriteProcessMemory
        
        PID:5960
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\6u7esswj.cmdline"
        20⤵
        Suspicious use of WriteProcessMemory
        
        PID:6000
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6095.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcCFE2F99BFBE54CC097822849B662CF72.TMP"
        21⤵
        
        PID:240
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        20⤵
        Suspicious use of WriteProcessMemory
        
        PID:264
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\nav4uh2x.cmdline"
        21⤵
        Suspicious use of WriteProcessMemory
        
        PID:2780
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES625A.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc315A35E2825C461B80853D377B3EA835.TMP"
        22⤵
        
        PID:5192
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        21⤵
        Suspicious use of WriteProcessMemory
        
        PID:3080
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\w2ei9oec.cmdline"
        22⤵
        Suspicious use of WriteProcessMemory
        
        PID:2900
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6400.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc2079BCB2F5C849D09022E9F264B864.TMP"
        23⤵
        
        PID:5128
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        22⤵
        Suspicious use of WriteProcessMemory
        
        PID:5492
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\puxl3mmp.cmdline"
        23⤵
        
        PID:1676
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES65D4.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcFA4992D534CE4E548CA8982ADB4DAE99.TMP"
        24⤵
        
        PID:592
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        23⤵
        
        PID:692
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\2opo3dp0.cmdline"
        24⤵
        
        PID:4300
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES678A.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc723808BC2D54474D967081561D55A2BB.TMP"
        25⤵
        
        PID:1888
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        24⤵
        
        PID:5716
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\czpwtgku.cmdline"
        25⤵
        
        PID:6004
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES694F.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcF4FB72ABA7B84C21A962F1CC2390AAEE.TMP"
        26⤵
        
        PID:840
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        25⤵
        
        PID:1416
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\fc_eefsv.cmdline"
        26⤵
        
        PID:3572
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6B14.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc4CF2B47D27D8465793494B2F3843FA.TMP"
        27⤵
        
        PID:3348
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        26⤵
        
        PID:1716
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\sxen6e-e.cmdline"
        27⤵
        
        PID:6096
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6CD9.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcC4E1B3843C154BC6B5619E8399BE5193.TMP"
        28⤵
        
        PID:4456
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        27⤵
        
        PID:1872
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ivp9gonw.cmdline"
        28⤵
        
        PID:3376
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6EBE.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc67E2BA84F3F0431880CE9F9EA9D8A351.TMP"
        29⤵
        
        PID:1164
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        28⤵
        
        PID:5916
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\6jg4orko.cmdline"
        29⤵
        
        PID:3232
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7083.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc56F420F716394EEA8872DFAA7837977C.TMP"
        30⤵
        
        PID:4332
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        29⤵
        
        PID:3024
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\cdd7ycoc.cmdline"
        30⤵
        
        PID:5392
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7267.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcC091668DDF240BE93E32E8AF352F14.TMP"
        31⤵
        
        PID:1624
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        30⤵
        
        PID:3468
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\do1-enuz.cmdline"
        31⤵
        
        PID:4740
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES744C.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc17600F5117645A28D9CB143BE901D42.TMP"
        32⤵
        
        PID:1260
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        31⤵
        
        PID:3440
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\cyaajfnw.cmdline"
        32⤵
        
        PID:1136
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES766E.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc3B944ECAAD2A4B4C9911A35ED3292.TMP"
        33⤵
        
        PID:4776
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        32⤵
        
        PID:1500
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\grcyqzsn.cmdline"
        33⤵
        
        PID:3556
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES77D6.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcB59F800CD8E49528AD2FB7B78F2A33A.TMP"
        34⤵
        
        PID:3300
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        33⤵
        
        PID:4364
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\9rrr4hpl.cmdline"
        34⤵
        
        PID:2700
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES793D.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcA539454F66FB4F1789FACD44686A2327.TMP"
        35⤵
        
        PID:3452
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        34⤵
        
        PID:3508
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\5xzxbbd2.cmdline"
        35⤵
        
        PID:2556
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7AE3.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc242A5B8D268543D88F8C425C7F3AE9BB.TMP"
        36⤵
        
        PID:1348
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        35⤵
        
        PID:4720
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\belbqjkm.cmdline"
        36⤵
        
        PID:3512
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7CC7.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc6C8E65648E5E48BB84E538911D1AF86D.TMP"
        37⤵
        
        PID:2452
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        36⤵
        
        PID:2948
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\emhxp44c.cmdline"
        37⤵
        
        PID:4748
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7E6D.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcB534BDB91CF745F58FC0EB467077C131.TMP"
        38⤵
        
        PID:2520
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        37⤵
        
        PID:4932
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\jo6gwjbc.cmdline"
        38⤵
        
        PID:6104
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8061.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcF1A6C2DAA5FE46AF97FCB341843A8334.TMP"
        39⤵
        
        PID:1436
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        38⤵
        
        PID:3108
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\cocnutbm.cmdline"
        39⤵
        
        PID:1276
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8294.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc28EC7879E3AB469EA1B76DF7E98DCDC.TMP"
        40⤵
        
        PID:5668
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        39⤵
        
        PID:5088
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\n01cm_74.cmdline"
        40⤵
        
        PID:2144
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES842A.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcDFDBACE42309451D96728C19E914A8FC.TMP"
        41⤵
        
        PID:1272
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        40⤵
        
        PID:956
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\jjszzzfh.cmdline"
        41⤵
        
        PID:4896
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES85E0.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc31BC161B15DF4C30B5A87A9EB8D4CE96.TMP"
        42⤵
        
        PID:4604
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        41⤵
        
        PID:2724
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\cvwcetl3.cmdline"
        42⤵
        
        PID:1196
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8802.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc972D8339CBA1449693445E1CE2241262.TMP"
        43⤵
        
        PID:4468
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        42⤵
        
        PID:2072
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\40s3iq_h.cmdline"
        43⤵
        
        PID:5200
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES89F6.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcC23A58A13CD44592AC26568C5BEBF28.TMP"
        44⤵
        
        PID:3160
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        43⤵
        
        PID:4840
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\o9mj8mt-.cmdline"
        44⤵
        
        PID:5568
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8B7D.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcC46F1750C194771919C6A53643E77B.TMP"
        45⤵
        
        PID:3064
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        44⤵
        
        PID:2504
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ztuk6tyk.cmdline"
        45⤵
        
        PID:4592
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8D23.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc8571852DF23C4CDD966A8F924B05C9.TMP"
        46⤵
        
        PID:1620
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        45⤵
        
        PID:2680
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\sllrdfmy.cmdline"
        46⤵
        
        PID:4132
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8ED8.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc8904CB158FBD41D6B6A0721AEFAB32BC.TMP"
        47⤵
        
        PID:1052
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        46⤵
        
        PID:3328
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\dwqclx8l.cmdline"
        47⤵
        
        PID:896
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES90CC.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcEE0787AEB974CF5A0DCA1F2C1EA58A.TMP"
        48⤵
        
        PID:1856
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        47⤵
        
        PID:1580
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\tqs5yrwk.cmdline"
        48⤵
        
        PID:2116
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9253.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc673FF8343BD24A268A811230C62CE4.TMP"
        49⤵
        
        PID:4880
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        48⤵
        
        PID:5836
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\snyuziah.cmdline"
        49⤵
        
        PID:240
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9447.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc5463AE5480404CE9BB4B4CAEE866C46F.TMP"
        50⤵
        
        PID:124
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        49⤵
        
        PID:5832
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\iyrgj-lp.cmdline"
        50⤵
        
        PID:5188
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES964B.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcF24ECEAA66B84FC7BCA76A85368249C2.TMP"
        51⤵
        
        PID:2744
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        50⤵
        
        PID:5152
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\7facs5vx.cmdline"
        51⤵
        
        PID:5952
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9810.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc3469D90FD6749D8AACDD2D6BFD1174.TMP"
        52⤵
        
        PID:2352
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        51⤵
        
        PID:1488
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\tvfepk7w.cmdline"
        52⤵
        
        PID:2748
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES99D5.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc315B687666A4416FB810E5381F5849B.TMP"
        53⤵
        
        PID:4160
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        52⤵
        
        PID:5056
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\cl2qpu9n.cmdline"
        53⤵
        
        PID:5668
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9B7B.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcEBD594FE0E64865BDAE893A8891A98.TMP"
        54⤵
        
        PID:4212
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        53⤵
        
        PID:3336
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ex3bcekz.cmdline"
        54⤵
        
        PID:4376
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9D21.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc8758C4E19A714930889A6CD309EA9F0.TMP"
        55⤵
        
        PID:3444
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        54⤵
        
        PID:6068
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ur52nelv.cmdline"
        55⤵
        
        PID:1720
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9EE6.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc2FE0F33F1FDD4B5ABC44C08F5462D9DE.TMP"
        56⤵
        
        PID:5016
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        55⤵
        
        PID:900
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\bj59rmog.cmdline"
        56⤵
        
        PID:4256
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA0AB.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc3D8B8BBE4F224E118C834D7BAE41CE7F.TMP"
        57⤵
        
        PID:5368
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        56⤵
        
        PID:4852
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\uxct7bko.cmdline"
        57⤵
        
        PID:6028
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA2FD.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc573B959845EA42FC9C73D42F5B3C3DC.TMP"
        58⤵
        
        PID:2304
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        57⤵
        
        PID:5828
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\yan0hzo1.cmdline"
        58⤵
        
        PID:4000
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA4F1.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc880ECBBDBDED4FD5A5C3B777E6DEF443.TMP"
        59⤵
        
        PID:3808
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        58⤵
        
        PID:1228
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\0jxuu86c.cmdline"
        59⤵
        
        PID:4792
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA6B6.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcA78A178C3FEE4E89AE56366EFA3EB0CF.TMP"
        60⤵
        
        PID:5408
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        59⤵
        
        PID:3564
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\zsav6ngu.cmdline"
        60⤵
        
        PID:4928
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA86B.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcD9C465FF373F4635864E77F64952A80.TMP"
        61⤵
        
        PID:4556
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        60⤵
        
        PID:1856
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\tges5xev.cmdline"
        61⤵
        
        PID:2236
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAA30.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc534929AAF8C94C3F907BC9BBA0B5E547.TMP"
        62⤵
        
        PID:2584
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        61⤵
        
        PID:1380
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\btcpoj-w.cmdline"
        62⤵
        
        PID:3252
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAC05.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcF7A01A9374934883BB9996839EED6238.TMP"
        63⤵
        
        PID:5900
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        62⤵
        
        PID:4544
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ud8gkjtw.cmdline"
        63⤵
        
        PID:2252
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAD9B.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcD5A9BE8E595C4AB383B97F498A634B2F.TMP"
        64⤵
        
        PID:5756
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        63⤵
        
        PID:1616
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\rg36hdgr.cmdline"
        64⤵
        
        PID:3332
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAF9F.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc83FA6CE8827414B9F59BABFAEB5A6B6.TMP"
        65⤵
        
        PID:1220
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        64⤵
        
        PID:2920
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\2no4b-1k.cmdline"
        65⤵
        
        PID:2060
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB135.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcA0D2678D4C474607A31ACE30906AAA7F.TMP"
        66⤵
        
        PID:1308
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        65⤵
        
        PID:4168
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ffw8mhhq.cmdline"
        66⤵
        
        PID:4492
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB2BC.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcEF434FFB902649309ADD7E6F6A27FEB.TMP"
        67⤵
        
        PID:5132
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        66⤵
        
        PID:5980
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\qtl06ivw.cmdline"
        67⤵
        
        PID:5748
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB462.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcA27854193C3845B4981475A7415FC5D.TMP"
        68⤵
        
        PID:1336
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        67⤵
        
        PID:1808
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\btgynwkt.cmdline"
        68⤵
        
        PID:4680
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB5D9.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcDCA933875EC44DBC83F2814D4A13F50.TMP"
        69⤵
        
        PID:3504
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        68⤵
        
        PID:1084
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\64cqsapk.cmdline"
        69⤵
        
        PID:1300
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB82B.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc4F5CAE15382F43FFA2973DB3C15BCAB.TMP"
        70⤵
        
        PID:3160
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        69⤵
        
        PID:2152
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\54ydllro.cmdline"
        70⤵
        
        PID:4596
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB9A2.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcDBC8A53E335F4A40A882CB8B69807DBF.TMP"
        71⤵
        
        PID:4732
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        70⤵
        
        PID:4532
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\6miuefpo.cmdline"
        71⤵
        
        PID:772
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESBC03.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc8D0941C8C5834C31A0D3C5E861C946D.TMP"
        72⤵
        
        PID:4312
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        71⤵
        
        PID:5800
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\thkbncmm.cmdline"
        72⤵
        
        PID:2940
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESBE45.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcEB84639DD182431B8AB254DED3DA2B75.TMP"
        73⤵
        
        PID:3860
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        72⤵
        
        PID:4948
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\jy1bst-n.cmdline"
        73⤵
        
        PID:5648
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESBFCC.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcBA52DC93D27B4472BE65E9B417B3DFE.TMP"
        74⤵
        
        PID:5988
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        73⤵
        
        PID:1960
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\rxbjhzod.cmdline"
        74⤵
        
        PID:4176
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC1A0.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc4FF5AF6266D043AFBABA6833520C864.TMP"
        75⤵
        
        PID:6060
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        74⤵
        
        PID:3220
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\kty-ulvd.cmdline"
        75⤵
        
        PID:256
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC385.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc3E809923A2B64A4595A46CDE566FCE9.TMP"
        76⤵
        
        PID:4268
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        75⤵
        
        PID:2180
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ynoja_lm.cmdline"
        76⤵
        
        PID:3156
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC4EC.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc366E14F2C2864778B0298AE6A8765627.TMP"
        77⤵
        
        PID:2520
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        76⤵
        
        PID:4100
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\9dq9pg-y.cmdline"
        77⤵
        
        PID:904
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC692.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcD5788A514FB74A1BB89F9DBBBFB85C40.TMP"
        78⤵
        
        PID:928
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        77⤵
        
        PID:5652
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\htdoioml.cmdline"
        78⤵
        
        PID:5076
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC876.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc1F94AEFEEEB14AD099AD33E510A2576E.TMP"
        79⤵
        
        PID:5356
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        78⤵
        
        PID:3444
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\tzi-yjd7.cmdline"
        79⤵
        
        PID:3916
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCA1C.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcE39147E79E7840A7B8B84E1C61E327C.TMP"
        80⤵
        
        PID:5016
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        79⤵
        
        PID:2944
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\8td7czft.cmdline"
        80⤵
        
        PID:4220
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCC4F.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcD5E7C2CFE996488B9FFDB929167195.TMP"
        81⤵
        
        PID:3528
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        80⤵
        
        PID:3992
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\f-ca9bco.cmdline"
        81⤵
        
        PID:3684
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCE81.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc21FE5C6223CB4111BE389FB141EE2F7.TMP"
        82⤵
        
        PID:3648
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        81⤵
        
        PID:5624
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\r656jzy1.cmdline"
        82⤵
        
        PID:1240
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD066.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcBCE1EAA275B44B74AB4BBDAC90FBA924.TMP"
        83⤵
        
        PID:5388
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        82⤵
        
        PID:4916
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\o0pujh9q.cmdline"
        83⤵
        
        PID:3240
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD279.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcDEDA458672D4B4787991217E3AA61C5.TMP"
        84⤵
        
        PID:4628
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        83⤵
        
        PID:1132
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\1bs051am.cmdline"
        84⤵
        
        PID:4228
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD4DA.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcB8297D7E74964C5EA3714E28F3D9235.TMP"
        85⤵
        
        PID:4692
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        84⤵
        
        PID:3148
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\9mh4-q7i.cmdline"
        85⤵
        
        PID:5484
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD6DE.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc235AC25FFB2445F4B95D8AA2DBBE1A43.TMP"
        86⤵
        
        PID:2308
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        85⤵
        
        PID:2792
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\1yix1cx4.cmdline"
        86⤵
        
        PID:5456
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD920.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc4E9FBA48D4114898948C98AE76C7451.TMP"
        87⤵
        
        PID:3448
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        86⤵
        
        PID:2784
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\hgvw0lms.cmdline"
        87⤵
        
        PID:2288
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESDAC6.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc4F216487BA184C5C969355BC2FEAA152.TMP"
        88⤵
        
        PID:2020
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        87⤵
        
        PID:4640
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\xyb5xiry.cmdline"
        88⤵
        
        PID:928
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESDC6C.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc294373245CEE46C0A2D975D678F422B3.TMP"
        89⤵
        
        PID:5708
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        88⤵
        
        PID:5060
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\tjina3nh.cmdline"
        89⤵
        
        PID:2808
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESDE12.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc7018F45714F146C791ED3C82441388F.TMP"
        90⤵
        
        PID:1776
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        89⤵
        
        PID:2036
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\89048ml8.cmdline"
        90⤵
        
        PID:3044
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESDFE6.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc1EBDD41AE06B46C0B9494E76F4C47894.TMP"
        91⤵
        
        PID:1692
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        90⤵
        
        PID:4276
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\wssdvedv.cmdline"
        91⤵
        
        PID:5368
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE19C.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc7DDE9D2CF9804FE4BCF262262B8E3434.TMP"
        92⤵
        
        PID:2492
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        91⤵
        
        PID:4436
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\kkj0pkes.cmdline"
        92⤵
        
        PID:4324
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE351.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcCD73117ACF224FDCB8FA83E9839190F1.TMP"
        93⤵
        
        PID:3344
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        92⤵
        
        PID:2484
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\kbltv06_.cmdline"
        93⤵
        
        PID:4224
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE584.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcA94F0FB28B1E4092A8EF1753F1406C23.TMP"
        94⤵
        
        PID:3872
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        93⤵
        
        PID:5408
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\qqvnajaa.cmdline"
        94⤵
        
        PID:2272
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE70B.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcB7D02A8C7304496CA2E2721109F28F5.TMP"
        95⤵
        
        PID:3460
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        94⤵
        
        PID:2860
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\et5-cxfp.cmdline"
        95⤵
        
        PID:1376
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE891.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc34B8A8E191E7405796E619AFD09BF8E0.TMP"
        96⤵
        
        PID:4584
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        95⤵
        
        PID:2308
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\heedncsp.cmdline"
        96⤵
        
        PID:4780
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESEA47.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcC468251D1DB84A6DA0CC4856C816EAE1.TMP"
        97⤵
        
        PID:5612
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        96⤵
        
        PID:3448
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\6ncc8bga.cmdline"
        97⤵
        
        PID:1172
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESEC1B.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc473FE0879A9E4D569EAAEC24EA4B92D0.TMP"
        98⤵
        
        PID:6040
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        97⤵
        
        PID:2352
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ivr-n0ky.cmdline"
        98⤵
        
        PID:4900
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESEDC1.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcFDF848F92A39492792E7BB4F1BE077CE.TMP"
        99⤵
        
        PID:5724
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        98⤵
        
        PID:3472
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\egvzhiqn.cmdline"
        99⤵
        
        PID:4416
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESEFB5.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc3CC9FA03CC2E4CE58DF8DB60F7222DF7.TMP"
        100⤵
        
        PID:2324
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        99⤵
        
        PID:4520
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\kyp3f2zn.cmdline"
        100⤵
        
        PID:1080
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF15B.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcEEB5089616884F919F26B817A5977F87.TMP"
        101⤵
        
        PID:5820
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        100⤵
        
        PID:2188
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\-u1raxog.cmdline"
        101⤵
        
        PID:2604
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF34F.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcA61AAB18FFBC4F49844E5A60BB848FD9.TMP"
        102⤵
        
        PID:2972
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        101⤵
        
        PID:5236
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\khrx9swt.cmdline"
        102⤵
        
        PID:4732
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF4D6.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcFCBEE7CE6E9F4CDF88A75C3F5CB66377.TMP"
        103⤵
        
        PID:3088
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        102⤵
        
        PID:5248
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ota0m1fg.cmdline"
        103⤵
        
        PID:3808
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF69B.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcD7D5D872A1844141B88A1D7BC794C8.TMP"
        104⤵
        
        PID:4888
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        103⤵
        
        PID:3748
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\jz5qbchy.cmdline"
        104⤵
        
        PID:5676
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF89F.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc23D0E28337FE476CAFD033E92451E3DD.TMP"
        105⤵
        
        PID:4356
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        104⤵
        
        PID:2640
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\xinvevi9.cmdline"
        105⤵
        
        PID:4564
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFA73.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc34A58956D3004D1A9D167CA58EFAE6C9.TMP"
        106⤵
        
        PID:3180
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        105⤵
        
        PID:3200
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ibnjtlt7.cmdline"
        106⤵
        
        PID:3172
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFBFA.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc52447018234149D79749427A4D76E37.TMP"
        107⤵
        
        PID:5900
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        106⤵
        
        PID:252
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\owsrkpet.cmdline"
        107⤵
        
        PID:4328
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFDA0.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc60F887A83A24AAF81158012FA3A11A0.TMP"
        108⤵
        
        PID:1056
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        107⤵
        
        PID:792
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\euiis1ok.cmdline"
        108⤵
        
        PID:2964
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFF65.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcF653FB62741D4093AEC65FFC4824D86.TMP"
        109⤵
        
        PID:1220
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        108⤵
        
        PID:4444
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\jwhef4o4.cmdline"
        109⤵
        
        PID:4476
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESEC.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcCFABC4332BCD4893BEBEA14A1122CF3.TMP"
        110⤵
        
        PID:2728
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        109⤵
        
        PID:3312
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\tvcnqlim.cmdline"
        110⤵
        
        PID:5632
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES272.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc6F8044D0B2904529BF33E5715634B21A.TMP"
        111⤵
        
        PID:5576
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        110⤵
        
        PID:4868
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\uean-yz3.cmdline"
        111⤵
        
        PID:1672
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES476.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc6BAEFA11E5EF48CC94F95713E9E9E0CB.TMP"
        112⤵
        
        PID:1252
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        111⤵
        
        PID:3088
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\xrtzko6u.cmdline"
        112⤵
        
        PID:1320
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES63B.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcF0C2748037644FCF96A24B4BBF8054.TMP"
        113⤵
        
        PID:3132
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        112⤵
        
        PID:4184
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\p9kqgjtd.cmdline"
        113⤵
        
        PID:5020
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7F0.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcF87663DB109845CD8490021FE51FA0.TMP"
        114⤵
        
        PID:2148
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        113⤵
        
        PID:3040
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\wn2mrcip.cmdline"
        114⤵
        
        PID:2636
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9E4.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc700DFB99C22D43FABE166263FFC9FFF6.TMP"
        115⤵
        
        PID:204
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        114⤵
        
        PID:5064
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\srkahvtl.cmdline"
        115⤵
        
        PID:2476
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB6B.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcB423AF546B65418BB776C6C0B065816.TMP"
        116⤵
        
        PID:5900
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        115⤵
        
        PID:5584
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\k3fg4zgd.cmdline"
        116⤵
        
        PID:2796
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD11.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcC3AB4EB329B74CA6809AE4682E566A84.TMP"
        117⤵
        
        PID:1384
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        116⤵
        
        PID:5184
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\2vafgzyo.cmdline"
        117⤵
        
        PID:4516
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF43.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc38F4E0AA671E45D2AB725716C56FD218.TMP"
        118⤵
        
        PID:3284
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        117⤵
        
        PID:4448
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\e39tjdhx.cmdline"
        118⤵
        
        PID:2396
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1157.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc7C9C07B9ABFC4EED8E232FFD74393753.TMP"
        119⤵
        
        PID:3884
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        118⤵
        
        PID:1108
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\gcnfbhbm.cmdline"
        119⤵
        
        PID:4604
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES130C.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc418EC3A6602148BFABF79CAB86B95474.TMP"
        120⤵
        
        PID:2140
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        119⤵
        
        PID:2496
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\6giu8c7z.cmdline"
        120⤵
        
        PID:428
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES14C2.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcF258F7D5CD934943A8D365B58A6C948.TMP"
        121⤵
        
        PID:2708
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        120⤵
        
        PID:5856
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\famdlf3k.cmdline"
        121⤵
        
        PID:2412
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1639.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcCD0A02D54C014B0AA63D4EF149FB5284.TMP"
        122⤵
        
        PID:2532
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        121⤵
        
        PID:1684
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\wzfihz6m.cmdline"
        122⤵
        
        PID:2312
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES17EE.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc6C9DCA493E2C4E67888F3FFC4E168DB.TMP"
        123⤵
        
        PID:5376
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        122⤵
        
        PID:3460
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\luipkr4n.cmdline"
        123⤵
        
        PID:5424
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES19A4.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc30269063CD394580B5231E4BCEE99949.TMP"
        124⤵
        
        PID:4684
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        123⤵
        
        PID:6044
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\uibdoly0.cmdline"
        124⤵
        
        PID:6056
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1B3A.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcDE8EB351E5F2452ABE3B3E84BC219F36.TMP"
        125⤵
        
        PID:676
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        124⤵
        
        PID:2084
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\n-zbgkhb.cmdline"
        125⤵
        
        PID:1364
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1D1E.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc324019DD249B4D49AED1D77E791E60F0.TMP"
        126⤵
        
        PID:5340
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        125⤵
        
        PID:1348
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\gqk0q6rl.cmdline"
        126⤵
        
        PID:2108
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1F32.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc90A23E93C640462B8526E65AD16BC3D.TMP"
        127⤵
        
        PID:5684
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        126⤵
        
        PID:4676
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\hj8pwimy.cmdline"
        127⤵
        
        PID:4292
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES20D7.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcD8C470A2E07C4ADFB6F27494E85720F4.TMP"
        128⤵
        
        PID:3544
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        127⤵
        
        PID:1340
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\04eh1cwv.cmdline"
        128⤵
        
        PID:3176
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES227D.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc5E129694DD5F4772A855FAC6FC15EFE.TMP"
        129⤵
        
        PID:5680
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        128⤵
        
        PID:2708
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\5iwbrepm.cmdline"
        129⤵
        
        PID:3344
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2462.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc2EABF8C127F04A8A8799FAE564E975EA.TMP"
        130⤵
        
        PID:5948
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        129⤵
        
        PID:4888
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ntmqpp1k.cmdline"
        130⤵
        
        PID:4332
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2656.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc268964FACD70414BB83FD7CBB4ED701.TMP"
        131⤵
        
        PID:3260
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        130⤵
        
        PID:4452
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ky3gya1q.cmdline"
        131⤵
        
        PID:5964
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2869.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc5B1EA758E04D46DE8736445C13676AD3.TMP"
        132⤵
        
        PID:4684
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        131⤵
        
        PID:4844
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\hccngi5_.cmdline"
        132⤵
        
        PID:4396
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2A2E.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc40A9D0628ACA4BF68B2C461C701B2E11.TMP"
        133⤵
        
        PID:6040
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        132⤵
        
        PID:124
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\37lqy70n.cmdline"
        133⤵
        
        PID:5900
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2C03.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc8E5780B45A57478CA39C3CA795E45E9A.TMP"
        134⤵
        
        PID:1900
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        133⤵
        
        PID:1780
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\yc3woi6q.cmdline"
        134⤵
        
        PID:4884
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2DF7.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc29CF69901E26402A8695BEBFC651F892.TMP"
        135⤵
        
        PID:4856
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        134⤵
        
        PID:2276
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\foxamfno.cmdline"
        135⤵
        
        PID:6048
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2FAC.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc2C6BCB0AEC944D5993F4781A8C779E2.TMP"
        136⤵
        
        PID:4468
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        135⤵
        
        PID:5792
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ndw1z2fy.cmdline"
        136⤵
        
        PID:840
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3181.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc2EE7316451B74B28B11F1B142CB54E72.TMP"
        137⤵
        
        PID:6064
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        136⤵
        
        PID:2892
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\gluszbcn.cmdline"
        137⤵
        
        PID:2492
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3365.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc10D154AA234346E2BE3927A187EDAE4D.TMP"
        138⤵
        
        PID:2532
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        137⤵
        
        PID:3384
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\3t9sdfeo.cmdline"
        138⤵
        
        PID:2692
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES34EC.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcB90B1E0F1B6B4D4C91CE6EC938447E9D.TMP"
        139⤵
        
        PID:4316
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        138⤵
        
        PID:2248
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\2lymuz-d.cmdline"
        139⤵
        
        PID:3692
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3692.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc7ED5741945E2444AB9D7AAA53A2598D.TMP"
        140⤵
        
        PID:1620
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        139⤵
        
        PID:2328
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\x836zkje.cmdline"
        140⤵
        
        PID:1448
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3847.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc7B992FCBAD474C85BA52C62A9F5234.TMP"
        141⤵
        
        PID:2020
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        140⤵
        
        PID:4268
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\_asd2jwj.cmdline"
        141⤵
        
        PID:1760
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3A3B.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc61E09BA56AF41A3BCC72E1207D9BB.TMP"
        142⤵
        
        PID:4632
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        141⤵
        
        PID:5976
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\akggmvox.cmdline"
        142⤵
        
        PID:2196
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3C10.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc2CC692BBCCB14789998B6D5D6FFDFC3E.TMP"
        143⤵
        
        PID:1056
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        142⤵
        
        PID:6016
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ksqukkaa.cmdline"
        143⤵
        
        PID:1816
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3DC6.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc5E6A77127087449DB692ABD945311834.TMP"
        144⤵
        
        PID:2896
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        143⤵
        
        PID:2008
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\wf6_mup2.cmdline"
        144⤵
        
        PID:1876
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3F6C.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcBDD34D16F3B14E3A83EDA2658F77F36D.TMP"
        145⤵
        
        PID:2284
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        144⤵
        
        PID:5280
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\xovubghp.cmdline"
        145⤵
        
        PID:4756
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4131.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcDF4192CE36C94DE98DC44B3B82E812C3.TMP"
        146⤵
        
        PID:5576
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        145⤵
        
        PID:5780
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ktghzaew.cmdline"
        146⤵
        
        PID:5704
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        147⤵
        
        PID:4316
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES42C7.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcE186EBEB59324978A84A151B851B11B.TMP"
        147⤵
        
        PID:2712
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        146⤵
        
        PID:2648
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\uvqrilki.cmdline"
        147⤵
        
        PID:1620
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES442E.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc322422D55DB4359A49A61BB08ED959.TMP"
        148⤵
        
        PID:4744
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        147⤵
        
        PID:2184
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\spthrcnf.cmdline"
        148⤵
        
        PID:2488
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4603.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc847D52612CA7460D90EB7349EE26422.TMP"
        149⤵
        
        PID:2916
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        148⤵
        
        PID:2032
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\cqpacszi.cmdline"
        149⤵
        
        PID:6140
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES478A.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcF68B8E38456943388FB3E1235833A991.TMP"
        150⤵
        
        PID:4336
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        149⤵
        
        PID:3284
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ykm2yxci.cmdline"
        150⤵
        
        PID:2960
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4901.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc261F524A901B41FD96F935FC18B023C0.TMP"
        151⤵
        
        PID:4116
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        150⤵
        
        PID:2896
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\12jay5-x.cmdline"
        151⤵
        
        PID:2424
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4A68.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc44DBF1E8C9BE47C08CA23A88FA5615A3.TMP"
        152⤵
        
        PID:4660
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        151⤵
        
        PID:1336
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\e4vq_9bp.cmdline"
        152⤵
        
        PID:5840
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4C4C.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcFC06D696559E4C74B6F534D95CC6428.TMP"
        153⤵
        
        PID:4312
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        152⤵
        
        PID:5104
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\mpdkhiav.cmdline"
        153⤵
        
        PID:3192
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4DE3.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcDDDCE553A8E4287B739C32BFBD9A85.TMP"
        154⤵
        
        PID:5480
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        153⤵
        
        PID:4284
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\cepqpak9.cmdline"
        154⤵
        
        PID:1252
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4FB7.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcCE02E0B7F08549FA87C788C13CF085E.TMP"
        155⤵
        
        PID:5660
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        154⤵
        
        PID:4744
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ikktjqfq.cmdline"
        155⤵
        
        PID:236
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES514E.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc73B06C8F4339400C90A1EC5C744AB20.TMP"
        156⤵
        
        PID:1824
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        155⤵
        
        PID:3728
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\v9dx12ti.cmdline"
        156⤵
        
        PID:868
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES52F4.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc1642F739DB0C49D199F565209B31F94A.TMP"
        157⤵
        
        PID:2040
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        156⤵
        
        PID:3852
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\-uweheeu.cmdline"
        157⤵
        
        PID:3716
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES54C8.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc4835BCD3111147209ED6B27EAFCB1F82.TMP"
        158⤵
        
        PID:3248
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        157⤵
        
        PID:4372
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\t3gaam86.cmdline"
        158⤵
        
        PID:3544
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES564F.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcED0BED4FD3AD4ABBAA3BDAC57CAEEBAE.TMP"
        159⤵
        
        PID:2728
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        158⤵
        
        PID:1748
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\tlhrsy4z.cmdline"
        159⤵
        
        PID:5872
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES57C6.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc512EAFA05B56443CA3926733BE19DB2.TMP"
        160⤵
        
        PID:2452
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        159⤵
        
        PID:5292
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\jvyfdrmr.cmdline"
        160⤵
        
        PID:3348
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES597B.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc393EE4D024643EB859580FC5C8A10B1.TMP"
        161⤵
        
        PID:4848
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        160⤵
        
        PID:3664
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\vhtup539.cmdline"
        161⤵
        
        PID:5884
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5AD3.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc44C0C29027994A8CB111518B1750CC10.TMP"
        162⤵
        
        PID:4560
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        161⤵
        
        PID:1328
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\4v2njow_.cmdline"
        162⤵
        
        PID:3756
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5C89.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcF11F1AE44304A6B95E0A7C02C749F83.TMP"
        163⤵
        
        PID:2020
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        162⤵
        
        PID:4688
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\zevmxm6h.cmdline"
        163⤵
        
        PID:4856
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5E2F.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcEDF31191D802404E93E2982C86778B0.TMP"
        164⤵
        
        PID:2372
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        163⤵
        
        PID:5048
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\eq4ms02t.cmdline"
        164⤵
        
        PID:4116
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5F96.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc3361FE36BC0C493E82A74F6AB5344755.TMP"
        165⤵
        
        PID:5972
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        164⤵
        
        PID:2520
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\9xqvw76q.cmdline"
        165⤵
        
        PID:2728
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES613C.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc93572324EAAB42CD9C162843EC16B9AA.TMP"
        166⤵
        
        PID:1884
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        165⤵
        
        PID:5680
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\tzl8x7hq.cmdline"
        166⤵
        
        PID:1996
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6301.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc3A6D371895CC4DA0B91C8E2B5CAF022.TMP"
        167⤵
        
        PID:3948
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        166⤵
        
        PID:3616
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\firmrfcc.cmdline"
        167⤵
        
        PID:5988
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6505.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcB1FE4B4E475F4343B14BE1D0B2F083B3.TMP"
        168⤵
        
        PID:2840
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        167⤵
        
        PID:3092
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\wzp6e4aq.cmdline"
        168⤵
        
        PID:3872
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES667C.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcAB7BD3CDDEA14F5AA0805722B29C9A1C.TMP"
        169⤵
        
        PID:2560
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        168⤵
        
        PID:6136
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\tphxjn3q.cmdline"
        169⤵
        
        PID:2916
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6812.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcF4067B4890A74C7983166D62436A1BF.TMP"
        170⤵
        
        PID:4336
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        169⤵
        
        PID:6036
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\vnd_capn.cmdline"
        170⤵
        
        PID:3832
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6A06.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc196612472B4C4044B44EAB95F055F87F.TMP"
        171⤵
        
        PID:3888
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        170⤵
        
        PID:2576
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\qfbbmkef.cmdline"
        171⤵
        
        PID:2428
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6B6D.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcB7A004E7920141699F74FC971B60A343.TMP"
        172⤵
        
        PID:200
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        171⤵
        
        PID:3404
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ecpshmas.cmdline"
        172⤵
        
        PID:4812
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6D42.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcEBF7E314A4FA42A5908448B8E9B75B5.TMP"
        173⤵
        
        PID:6064
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        172⤵
        
        PID:5500
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\fbmuzeyk.cmdline"
        173⤵
        
        PID:1000
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6ED8.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcF34B35BAA0F247B6B195C2CB43CF4788.TMP"
        174⤵
        
        PID:2304
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        173⤵
        
        PID:5576
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\vrzs_ffv.cmdline"
        174⤵
        
        PID:5480
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES708E.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcF3765DA71FAE4EAE8A4A32B653EA9136.TMP"
        175⤵
        
        PID:3180
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        174⤵
        
        PID:4344
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\iqkuz8fm.cmdline"
        175⤵
        
        PID:2464
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7224.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc188518ED55AD4DC79BDDB95CF4D32051.TMP"
        176⤵
        
        PID:3316
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        175⤵
        
        PID:3704
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\7yvldjxr.cmdline"
        176⤵
        
        PID:300
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7408.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcD0A2919F88004506AFE0DF5727536BB8.TMP"
        177⤵
        
        PID:2716
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        176⤵
        
        PID:5016
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\7r9beplm.cmdline"
        177⤵
        
        PID:3696
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES75BE.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc4301E914354F4561B670D174E6BC793.TMP"
        178⤵
        
        PID:1032
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        177⤵
        
        PID:2868
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\9wjgpian.cmdline"
        178⤵
        
        PID:5488
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7744.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcF1961147ECB94CFC8CA1D1C95B4FA02B.TMP"
        179⤵
        
        PID:3612
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        178⤵
        
        PID:5948
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ivnwvr_o.cmdline"
        179⤵
        
        PID:1052
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES78EA.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcA2F0D5E14CA24CCE82A58CC87AED21A8.TMP"
        180⤵
        
        PID:752
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        179⤵
        
        PID:5460
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\fhh_xmvv.cmdline"
        180⤵
        
        PID:2752
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7AA0.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc241C569F34264E74BBC77588B94C88.TMP"
        181⤵
        
        PID:3908
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        180⤵
        
        PID:5504
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ttpsefti.cmdline"
        181⤵
        
        PID:5756
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7C75.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc4C8DF2AD5B7744619561E0FA2523CB3D.TMP"
        182⤵
        
        PID:5372
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        181⤵
        
        PID:4104
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\f2ajt4la.cmdline"
        182⤵
        
        PID:5908
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7E0B.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc39371BEB837F45DDB05375683E1F2B49.TMP"
        183⤵
        
        PID:3636
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        182⤵
        
        PID:3032
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\e-08tss3.cmdline"
        183⤵
        
        PID:5068
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        184⤵
        
        PID:1032
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7FA1.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc97A69417958A492599B4502DFE377F1.TMP"
        184⤵
        
        PID:4368
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        183⤵
        
        PID:400
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\cxb_97ps.cmdline"
        184⤵
        
        PID:3612
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8128.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc8411C9FE67B54361B6686A91CEB9FE83.TMP"
        185⤵
        
        PID:5300
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        184⤵
        
        PID:3260
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\xkjm0ly4.cmdline"
        185⤵
        
        PID:752
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES82CE.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc1458D08BD32F482881F4AA7FBB1D6655.TMP"
        186⤵
        
        PID:2284
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        185⤵
        
        PID:4180
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\svhcvcjy.cmdline"
        186⤵
        
        PID:3160
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8464.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc38883A5F8E4E4F0DB2DECD03C18E65.TMP"
        187⤵
        
        PID:2148
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        186⤵
        
        PID:4632
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\l-fc7iwx.cmdline"
        187⤵
        
        PID:1476
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8639.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc4FE2E235743B450A8F864F6FFA2787C.TMP"
        188⤵
        
        PID:5196
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        187⤵
        
        PID:2880
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\bjpjvgyt.cmdline"
        188⤵
        
        PID:1368
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES87CF.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc31E068A550214869A742F4B549796F15.TMP"
        189⤵
        
        PID:1384
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        188⤵
        
        PID:3580
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\nbk1cbee.cmdline"
        189⤵
        
        PID:1236
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8955.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc43CC918663AC4187BB60A65E9C11CFC9.TMP"
        190⤵
        
        PID:4816
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        189⤵
        
        PID:2500
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\twavdwhz.cmdline"
        190⤵
        
        PID:5920
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8B49.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc362EA771B9D34AD3BDD5977C60702B5C.TMP"
        191⤵
        
        PID:3884
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        190⤵
        
        PID:2388
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\8wjqmcwk.cmdline"
        191⤵
        
        PID:4608
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8CFF.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc6AA2E001BD8D4D439AB35BFF31874BC.TMP"
        192⤵
        
        PID:5612
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        191⤵
        
        PID:2712
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\yw0aa5ml.cmdline"
        192⤵
        
        PID:820
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8F03.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc37D7BB0B1C73497BBB11AD7F7A52143B.TMP"
        193⤵
        
        PID:5196
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        192⤵
        
        PID:1168
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\zvclrh6k.cmdline"
        193⤵
        
        PID:1004
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9099.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcFBCB9C1C83BB4AC9971F6D06FDB7762.TMP"
        194⤵
        
        PID:936
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        193⤵
        
        PID:4964
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\k1ectyah.cmdline"
        194⤵
        
        PID:4480
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9607.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcE2620DB9BBF443D1AF849ADABFAC3B2.TMP"
        195⤵
        
        PID:6064
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        194⤵
        
        PID:5376
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\fu-whcen.cmdline"
        195⤵
        
        PID:1244
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES980B.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcC4C9E737D59D4C11B8638A2DFFF85B34.TMP"
        196⤵
        
        PID:4696
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        195⤵
        
        PID:1124
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\3znxtgus.cmdline"
        196⤵
        
        PID:3048
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9A5D.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcA7E5638011B94096863EE0CA64D36B25.TMP"
        197⤵
        
        PID:2532
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        196⤵
        
        PID:2852
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\sx9eulww.cmdline"
        197⤵
        
        PID:4160
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9C03.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcEB0CA486531846F2A2F5C7A6D38A28A0.TMP"
        198⤵
        
        PID:5372
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        197⤵
        
        PID:3168
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ihnrl_ki.cmdline"
        198⤵
        
        PID:916
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        199⤵
        
        PID:936
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9DD7.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcB82BFA4B27C846BBBB49F3ACE364562F.TMP"
        199⤵
        
        PID:3076
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        198⤵
        
        PID:4708
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\h6eoegxj.cmdline"
        199⤵
        
        PID:6064
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9F6E.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc71C1C76C6C249DBBD34EAD0DA262ED3.TMP"
        200⤵
        
        PID:1436
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        199⤵
        
        PID:1888
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\uztt-j6g.cmdline"
        200⤵
        
        PID:4212
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA123.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcDFCBF7F871294109A00776ACC7B86B8.TMP"
        201⤵
        
        PID:5684
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        200⤵
        
        PID:4828
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\qlwlpmc9.cmdline"
        201⤵
        
        PID:4468
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA2D9.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc26355B00B77B4D458DBC87AC9582A3CD.TMP"
        202⤵
        
        PID:616
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        201⤵
        
        PID:3316
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\dybj_bn6.cmdline"
        202⤵
        
        PID:2560
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA48E.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcF0DD1673C851427487A8DCF63181B840.TMP"
        203⤵
        
        PID:2324
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        202⤵
        
        PID:4636
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\d18cpcz6.cmdline"
        203⤵
        
        PID:5356
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA653.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc1303C48CE0BE488FA509087428D2A55.TMP"
        204⤵
        
        PID:2012
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        203⤵
        
        PID:1988
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\fxgtv4jk.cmdline"
        204⤵
        
        PID:4820
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA7EA.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc67815509198B4E5FA951DD9ABA8C9295.TMP"
        205⤵
        
        PID:5708
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        204⤵
        
        PID:1524
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\yaq8pwrs.cmdline"
        205⤵
        
        PID:2284
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA99F.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcF860D7C5133C476DA23E399B2BDDD442.TMP"
        206⤵
        
        PID:3420
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        205⤵
        
        PID:5144
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\m1rtbx5z.cmdline"
        206⤵
        
        PID:4316
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAB45.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc8CC29D147FC4C379DAFA9CD57E9CDA1.TMP"
        207⤵
        
        PID:3636
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        206⤵
        
        PID:4644
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\supx4_j0.cmdline"
        207⤵
        
        PID:4504
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESACDB.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc7C91363CFBF848359BC39CC74C5CD6E.TMP"
        208⤵
        
        PID:3920
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        207⤵
        
        PID:2844
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\m03ceu7o.cmdline"
        208⤵
        
        PID:1056
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAEA0.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc2A037FF7C4D34DF19B423A441397D210.TMP"
        209⤵
        
        PID:3028
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        208⤵
        
        PID:5164
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\uscn7dlz.cmdline"
        209⤵
        
        PID:4560
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB056.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc1099A31C43FC4BD99BFEDF71785C1E2.TMP"
        210⤵
        
        PID:4940
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        209⤵
        
        PID:3888
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\0qsc7a9p.cmdline"
        210⤵
        
        PID:3908
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB1EC.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc3FBD373D40CD4BD4AADB4138E442B6C1.TMP"
        211⤵
        
        PID:3372
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        210⤵
        
        PID:848
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\vmfdrlky.cmdline"
        211⤵
        
        PID:5084
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB382.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcBB431662D1C048249A2C2E3B596D969.TMP"
        212⤵
        
        PID:4936
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        211⤵
        
        PID:676
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\tcdmkft9.cmdline"
        212⤵
        
        PID:1900
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB538.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc656B216E7D154D9F948845EC8EA35560.TMP"
        213⤵
        
        PID:4136
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        212⤵
        
        PID:1892
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\7h5lsyqk.cmdline"
        213⤵
        
        PID:2664
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB6DE.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcD77496D452364AF296B47B1AC3B39D1.TMP"
        214⤵
        
        PID:1832
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        213⤵
        
        PID:4456
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\6qj_mbjj.cmdline"
        214⤵
        
        PID:2324
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB8A3.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc57BCD6C8FC04CCA8D8CC17816C650C8.TMP"
        215⤵
        
        PID:1496
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        214⤵
        
        PID:2572
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\nouknr5q.cmdline"
        215⤵
        
        PID:5388
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESBA0A.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc1E9BAD373504425EAFDB262C43CEA924.TMP"
        216⤵
        
        PID:3940
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        215⤵
        
        PID:5284
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\gjrrfusv.cmdline"
        216⤵
        
        PID:4348
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESBC0E.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc7413F1D691C94CC1AE30ED2A5872346.TMP"
        217⤵
        
        PID:3648
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        216⤵
        
        PID:3060
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\jevluqeq.cmdline"
        217⤵
        
        PID:5820
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESBDA4.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcC4E9AB266B6421493A8BE85263A01D.TMP"
        218⤵
        
        PID:6012
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        217⤵
        
        PID:3132
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\k1uxxgcu.cmdline"
        218⤵
        
        PID:4304
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESBF88.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcD08C8EA1711F40D09678235B7491CDFE.TMP"
        219⤵
        
        PID:4648
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        218⤵
        
        PID:5932
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\l8aforph.cmdline"
        219⤵
        
        PID:3076
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC12E.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcCC33E7F0FF094D32AC1DFBAE25301136.TMP"
        220⤵
        
        PID:4848
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        219⤵
        
        PID:1272
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\gtjvs81w.cmdline"
        220⤵
        
        PID:5708
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC2C5.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc4A068336C1814E5DB18EDC622FE538E.TMP"
        221⤵
        
        PID:5944
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        220⤵
        
        PID:576
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\f1cs6tgj.cmdline"
        221⤵
        
        PID:2584
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC46A.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc5649CDFDDA9E4F38A95BD3ABB9CEFB22.TMP"
        222⤵
        
        PID:3920
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        221⤵
        
        PID:4648
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\7mcdaszd.cmdline"
        222⤵
        
        PID:6084
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC620.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcE0A05E8D7F694B04807B3C9F541A539.TMP"
        223⤵
        
        PID:3028
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        222⤵
        
        PID:3268
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\us_69d-i.cmdline"
        223⤵
        
        PID:4356
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC7A7.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc75CBFBAA7FE84F25B3AE471E3DCD783E.TMP"
        224⤵
        
        PID:1444
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        223⤵
        
        PID:5944
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\nwm9bbcy.cmdline"
        224⤵
        
        PID:3480
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC93D.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcD809D9A3762C413EB43ED20417BBECC.TMP"
        225⤵
        
        PID:4420
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        224⤵
        
        PID:4620
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\nvumxhhg.cmdline"
        225⤵
        
        PID:5340
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCAB4.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcC420742C406E40F9A7A27E4BA58BC5E.TMP"
        226⤵
        
        PID:936
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        225⤵
        
        PID:3452
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\-gacs34l.cmdline"
        226⤵
        
        PID:1824
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCC69.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc4A33E548318445749816D345EC3F171.TMP"
        227⤵
        
        PID:3288
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        226⤵
        
        PID:4716
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\84u3q3kh.cmdline"
        227⤵
        
        PID:4600
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCE1F.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc5D5C2CB2C64895A143B66C2E7824AA.TMP"
        228⤵
        
        PID:1032
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        227⤵
        
        PID:2372
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\a5f_b2tr.cmdline"
        228⤵
        
        PID:1420
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD022.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcF9473A00F96346E4967641557B2A665A.TMP"
        229⤵
        
        PID:2000
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        228⤵
        
        PID:5004
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\f7jlmk4j.cmdline"
        229⤵
        
        PID:4204
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD236.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc5A8F67415E914758842E0F7255CF568.TMP"
        230⤵
        
        PID:4692
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        229⤵
        
        PID:6060
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\p4mxny5w.cmdline"
        230⤵
        
        PID:3248
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD3CC.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc6E7B33B999D24F4CA43D6386F26D268.TMP"
        231⤵
        
        PID:5380
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        230⤵
        
        PID:1384
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\hliwugfn.cmdline"
        231⤵
        
        PID:3752
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD543.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc6B2D1DE6A5F43998EAFF5EFB7B4FB64.TMP"
        232⤵
        
        PID:5660
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        231⤵
        
        PID:5196
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\jgeaokjp.cmdline"
        232⤵
        
        PID:2840
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD6D9.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcC0331BE963C24A3BAB28613AC8B4DC.TMP"
        233⤵
        
        PID:5508
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        232⤵
        
        PID:944
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\yiaq09v4.cmdline"
        233⤵
        
        PID:4368
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD8BE.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc124A7DDA86344229BD96FF2F19DA27EA.TMP"
        234⤵
        
        PID:1896
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        233⤵
        
        PID:3968
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\c1sjt1ag.cmdline"
        234⤵
        
        PID:1164
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESDA54.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc1C84FFB13E6B474C9C402F318C2A8A42.TMP"
        235⤵
        
        PID:3028
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        234⤵
        
        PID:4380
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\p-bkvfnu.cmdline"
        235⤵
        
        PID:696
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESDBFA.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcDB9EF883740B40A39CB41DCB7A3CDD4.TMP"
        236⤵
        
        PID:5472
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        235⤵
        
        PID:4092
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\q5cwvag0.cmdline"
        236⤵
        
        PID:3860
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESDDCE.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc62A44AF2F8C84C9B9C81CB94A9804585.TMP"
        237⤵
        
        PID:2436
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        236⤵
        
        PID:3372
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\rn_0tirj.cmdline"
        237⤵
        
        PID:1696
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESDF84.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc7652D513DE845FBA9E33675BA9CB386.TMP"
        238⤵
        
        PID:3552
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        237⤵
        
        PID:2468
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\b9tscimb.cmdline"
        238⤵
        
        PID:4124
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE10B.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcAA2D9CC7D108445789F216BBD775782.TMP"
        239⤵
        
        PID:4712
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        238⤵
        
        PID:5372
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\_63jegij.cmdline"
        239⤵
        
        PID:4108
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE2C0.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc7B9B752E613A4ED3816F37E3FF5C93E.TMP"
        240⤵
        
        PID:3732
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        239⤵
        
        PID:4776
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\hoosh-xk.cmdline"
        240⤵
        
        PID:5636
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE4C4.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcED5E53814BDC4DD7BCF0165DB5271C28.TMP"
        241⤵
        
        PID:2416
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        240⤵
        
        PID:5508
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\qogszg9z.cmdline"
        241⤵
        
        PID:4864
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE689.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc7A37948325BE4E86A6428292B77F4F6.TMP"
        242⤵
        
        PID:3596
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        241⤵
        
        PID:1956
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\6l8ts7b-.cmdline"
        242⤵
        
        PID:3552
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE80F.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcD1F76702FEC54F3AB355D4C040A7142E.TMP"
        243⤵
        
        PID:2828
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        242⤵
        
        PID:3648
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\lrzde81g.cmdline"
        243⤵
        
        PID:4500
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE9C5.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc97BD3D418E8A4C11AD2DEED9B876220.TMP"
        244⤵
        
        PID:2596
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        243⤵
        
        PID:3924
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\bzn9ckmi.cmdline"
        244⤵
        
        PID:5808
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESEB5B.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcF60C1847225444683D91545F6BD66F.TMP"
        245⤵
        
        PID:6080
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        244⤵
        
        PID:3196
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\1tja6yv3.cmdline"
        245⤵
        
        PID:3084
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESECF1.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc2450612A15F64775BB5E6A1A3DC6A093.TMP"
        246⤵
        
        PID:5472
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        245⤵
        
        PID:6092
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\2tdbgehr.cmdline"
        246⤵
        
        PID:1976
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESEE59.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcF7E4E411EB4344FB8FF4F141775A8B2C.TMP"
        247⤵
        
        PID:3456
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        246⤵
        
        PID:1796
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\skmdmfpl.cmdline"
        247⤵
        
        PID:5316
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESEFEF.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc9651824941984BEABB259625B38F23E8.TMP"
        248⤵
        
        PID:5132
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        247⤵
        
        PID:1032
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\nrf6jvz9.cmdline"
        248⤵
        
        PID:4140
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF1A5.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc97A6B433AF1B4ABABCBA38331DCE9D4B.TMP"
        249⤵
        
        PID:6080
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        248⤵
        
        PID:5380
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\rq7wx7lm.cmdline"
        249⤵
        
        PID:5396
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF36A.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcAE675A7514D645CBB64F404E137B4FCA.TMP"
        250⤵
        
        PID:4200
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        249⤵
        
        PID:3636
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\m5cvtahp.cmdline"
        250⤵
        
        PID:6040
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF4E1.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcCE5F4513CBDF4E84BE9D32E1388E9920.TMP"
        251⤵
        
        PID:5180
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        250⤵
        
        PID:5972
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\paozh5dy.cmdline"
        251⤵
        
        PID:1504
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF677.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc9A72B476F6D74998B59488943CDA2A.TMP"
        252⤵
        
        PID:4384
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        251⤵
        
        PID:3668
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\uymo0vyp.cmdline"
        252⤵
        
        PID:5892
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF81D.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcFFAA76CEDF69416AA2D883D85A5B048.TMP"
        253⤵
        
        PID:3732
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        252⤵
        
        PID:4924
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\c4fp-4gp.cmdline"
        253⤵
        
        PID:1776
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF9C3.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcD8C8A4C343624B62993EDF90D378BC9F.TMP"
        254⤵
        
        PID:2364
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        253⤵
        
        PID:3216
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\lkz2fyp1.cmdline"
        254⤵
        
        PID:1256
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFB59.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc7A1F04D3D930495781A62B30CA20669A.TMP"
        255⤵
        
        PID:4428
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        254⤵
        
        PID:6032
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\op51kphn.cmdline"
        255⤵
        
        PID:1304
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFCE0.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc545CB04ED1A04504A38E16E3D86B16F3.TMP"
        256⤵
        
        PID:4588
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        255⤵
        
        PID:1260
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\4lrqdgox.cmdline"
        256⤵
        
        PID:5616
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFE66.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcCF941D9FF7F04483AB73DE39E1246C73.TMP"
        257⤵
        
        PID:1444
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        256⤵
        
        PID:6076
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\_3pwqikw.cmdline"
        257⤵
        
        PID:5684
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1C.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc5FE860F045F54F7B9492C467B1712AF6.TMP"
        258⤵
        
        PID:2436
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        257⤵
        
        PID:1016
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\fhwtmbpg.cmdline"
        258⤵
        
        PID:3120
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1E1.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcD637A173CE054DD4A41C2C516932BB.TMP"
        259⤵
        
        PID:5912
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        258⤵
        
        PID:4156
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\jigc2kwn.cmdline"
        259⤵
        
        PID:1768
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES339.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc920211042674C59B66D9FEAE97CB5AB.TMP"
        260⤵
        
        PID:1308
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        259⤵
        
        PID:1724
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\de5gbqal.cmdline"
        260⤵
        
        PID:2304
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4EE.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc3AB16277A1FE4682817CFF13884F844.TMP"
        261⤵
        
        PID:616
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        260⤵
        
        PID:936
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\i7_ijdyi.cmdline"
        261⤵
        
        PID:3008
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6D2.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc161D912EC14D42378ABCECCEBB3CC058.TMP"
        262⤵
        
        PID:5880
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        261⤵
        
        PID:1624
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\cbzce2rh.cmdline"
        262⤵
        
        PID:5776
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8C6.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc67BA93EEBBBC4242B91FA858FBB1F62.TMP"
        263⤵
        
        PID:3940
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        262⤵
        
        PID:5012
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\wpatqlqq.cmdline"
        263⤵
        
        PID:2012
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAAB.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc8F124CF218C54A4E9764C0C01462D25.TMP"
        264⤵
        
        PID:2656
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        263⤵
        
        PID:3320
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\nexfaacr.cmdline"
        264⤵
        
        PID:5468
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC80.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc19D8D6F9D35468E9E5C1E202095283.TMP"
        265⤵
        
        PID:2436
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        264⤵
        
        PID:200
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\_0qnh6pt.cmdline"
        265⤵
        
        PID:5760
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESED1.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc9A907E8AF934D07822D3683AEBF92B0.TMP"
        266⤵
        
        PID:4428
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        265⤵
        
        PID:1152
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\25x4dhnj.cmdline"
        266⤵
        
        PID:1432
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES10E5.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcFE2C6E6F4124A7AB2233F90FF7A5AED.TMP"
        267⤵
        
        PID:6080
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        266⤵
        
        PID:1428
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\t6u_8q6z.cmdline"
        267⤵
        
        PID:4860
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1336.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc9DBD8BBC8B86489990D0BD2ABFC1E55.TMP"
        268⤵
        
        PID:980
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        267⤵
        
        PID:1740
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\z9zflhiy.cmdline"
        268⤵
        
        PID:5192
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1559.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc9FE9D0F237104E7CBFBEDCA11CC3967D.TMP"
        269⤵
        
        PID:2452
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        268⤵
        
        PID:3456
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\dwlqmgyn.cmdline"
        269⤵
        
        PID:2140
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES173E.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc2C0459F827E49E598A73EA570D2F2.TMP"
        270⤵
        
        PID:6080
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        269⤵
        
        PID:3300
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ilm1kaq_.cmdline"
        270⤵
        
        PID:2972
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1970.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcF51782B6E5474FDD97649299959CA62.TMP"
        271⤵
        
        PID:2148
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        270⤵
        
        PID:4120
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\6sqyi7xh.cmdline"
        271⤵
        
        PID:3028
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1B83.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcC353597B34EF4CFCB7E84CE86619D4A.TMP"
        272⤵
        
        PID:796
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        271⤵
        
        PID:4200
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\uhrv9jrb.cmdline"
        272⤵
        
        PID:4576
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1D58.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc7505DCF33F004FC390C0C42AE7E69090.TMP"
        273⤵
        
        PID:4712
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        272⤵
        
        PID:2772
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\kaurspq-.cmdline"
        273⤵
        
        PID:5332
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1F4C.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc960FE09619BC4B77B7111AAECE513E.TMP"
        274⤵
        
        PID:6024
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        273⤵
        
        PID:3840
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\4yeng3ai.cmdline"
        274⤵
        
        PID:4252
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES20E2.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc6923EB0E3FBC4810B659384033515E47.TMP"
        275⤵
        
        PID:2364
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        274⤵
        
        PID:1812
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\0l0l6d-4.cmdline"
        275⤵
        
        PID:3560
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES22C7.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc55F6078979E34CED85E277146A83A57.TMP"
        276⤵
        
        PID:2020
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        275⤵
        
        PID:2716
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\m5ujy9n5.cmdline"
        276⤵
        
        PID:1444
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        277⤵
        
        PID:6024
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES24EA.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc1355484CF4274E5EBAC93F06BD5E437.TMP"
        277⤵
        
        PID:3920
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        276⤵
        
        PID:5160
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\yt2ddztd.cmdline"
        277⤵
        
        PID:3584
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES26BE.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcB7CA5F86B18F4184B2E7585923938FB8.TMP"
        278⤵
        
        PID:2656
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        277⤵
        
        PID:5796
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\cqzrcrn7.cmdline"
        278⤵
        
        PID:3288
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES295E.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc47B7CDFDB05E434AB52ED6437F48787E.TMP"
        279⤵
        
        PID:1308
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        278⤵
        
        PID:5752
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\bfr_120w.cmdline"
        279⤵
        
        PID:1496
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2BB0.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcCA57468DEBAA4A73B0AAD4642A7FB788.TMP"
        280⤵
        
        PID:4940
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        279⤵
        
        PID:4428
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\7znx3wcl.cmdline"
        280⤵
        
        PID:2384
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2DB4.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcCEE2A956D27042A4BF29BF36F7715AB2.TMP"
        281⤵
        
        PID:3488
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        280⤵
        
        PID:3152
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\3mno-xfv.cmdline"
        281⤵
        
        PID:4360
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2F88.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc634C24EAA0CB4FA28F91B8F1FED689D.TMP"
        282⤵
        
        PID:2988
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        281⤵
        
        PID:2436
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\rppsk1yi.cmdline"
        282⤵
        
        PID:5300
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES317C.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcA219FF32257F41C496A6F1D6A06DAF1C.TMP"
        283⤵
        
        PID:4536
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        282⤵
        
        PID:2020
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\swgnpuzn.cmdline"
        283⤵
        
        PID:1592
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3351.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcF724BA05A3544F759C5FE78F53E468DE.TMP"
        284⤵
        
        PID:3064
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        283⤵
        
        PID:3380
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\mlbphkpk.cmdline"
        284⤵
        
        PID:1840
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3535.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc6B95ED0A4DBC4E72ACD2771DA6D5ECA1.TMP"
        285⤵
        
        PID:1832
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        284⤵
        
        PID:5936
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\hp_lux1o.cmdline"
        285⤵
        
        PID:5128
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3778.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc2FDFCDFD6E4744A3A34D3B82636C562D.TMP"
        286⤵
        
        PID:3492
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        285⤵
        
        PID:2652
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\2uvben_i.cmdline"
        286⤵
        
        PID:5472
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES398B.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcB6777B7593194AD4BAEB3B9FD96186.TMP"
        287⤵
        
        PID:1832
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        286⤵
        
        PID:4528
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\zf8c1znf.cmdline"
        287⤵
        
        PID:5180
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3B31.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc9B3971EF1C3546A6B8B723E09A4680D5.TMP"
        288⤵
        
        PID:2756
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        287⤵
        
        PID:5612
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\pfhqa0lt.cmdline"
        288⤵
        
        PID:796
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3D25.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc668F4D9C22F0488397D0EFD4B3D029AE.TMP"
        289⤵
        
        PID:4280
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        288⤵
        
        PID:4984
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\zlatm7w1.cmdline"
        289⤵
        
        PID:4320
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3ECB.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcBC63AB7F9FEA4C9D84B9401BF5254D79.TMP"
        290⤵
        
        PID:5912
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        289⤵
        
        PID:5132
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\pzkxyt7v.cmdline"
        290⤵
        
        PID:4712
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4080.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc4D58871D33F47A08E5CE0D33DFD3082.TMP"
        291⤵
        
        PID:1896
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        290⤵
        
        PID:5924
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\tceidi21.cmdline"
        291⤵
        
        PID:2364
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4236.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc720BA1AA44B343D18E8419B64811FCC0.TMP"
        292⤵
        
        PID:5660
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        291⤵
        
        PID:6024
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\zann-a0k.cmdline"
        292⤵
        
        PID:3940
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        293⤵
        
        PID:1896
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES43AD.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcD9746BB6CB344F1D932A92E18466FDC.TMP"
        293⤵
        
        PID:3516
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        292⤵
        
        PID:1756
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\yeexfs_x.cmdline"
        293⤵
        
        PID:2996
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4543.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc5186F19278114A45ACA2BFD3B3C6F497.TMP"
        294⤵
        
        PID:1972
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        293⤵
        
        PID:4432
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\scnku0kv.cmdline"
        294⤵
        
        PID:3732
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4737.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc77C47074E0E84F74B4FC6D61EE5AF1A8.TMP"
        295⤵
        
        PID:1220
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        294⤵
        
        PID:5660
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\isxvnypf.cmdline"
        295⤵
        
        PID:3784
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES495A.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc62C73EF6ED31440BA247417383949E54.TMP"
        296⤵
        
        PID:1464
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        295⤵
        
        PID:1100
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\v_5hrf94.cmdline"
        296⤵
        
        PID:3100
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4B1F.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc857AB86E9F754ED1A3D1C671CDB61C63.TMP"
        297⤵
        
        PID:4684
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        296⤵
        
        PID:2988
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\qawdvrbr.cmdline"
        297⤵
        
        PID:568
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4D13.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc8DC0D5642D0A458982D0680E1384E85.TMP"
        298⤵
        
        PID:3592
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        297⤵
        
        PID:4384
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\qwrmgcuf.cmdline"
        298⤵
        
        PID:3368
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4F26.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcC47C55A9C7774018B750935F5765468.TMP"
        299⤵
        
        PID:1220
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        298⤵
        
        PID:472
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\xs7kdp2c.cmdline"
        299⤵
        
        PID:3884
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES50BC.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc6FB9F82094ED4F109CCD377DCCA37FD6.TMP"
        300⤵
        
        PID:2316
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        299⤵
        
        PID:2120
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\p9matapz.cmdline"
        300⤵
        
        PID:2828
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5281.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcC1A4E6B75DC4441AA5BB128D9B341B66.TMP"
        301⤵
        
        PID:2756
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        300⤵
        
        PID:3064
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\x9dn0eub.cmdline"
        301⤵
        
        PID:980
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5550.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc6C68B725B8DB4119AC7BFB892E894FF.TMP"
        302⤵
        
        PID:4484
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        301⤵
        
        PID:4788
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\mg4guyfe.cmdline"
        302⤵
        
        PID:4536
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES57B2.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc2F0B3BBDDEDA483F98D0281B152CAB83.TMP"
        303⤵
        
        PID:1896
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        302⤵
        
        PID:2380
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\vzc_gkxo.cmdline"
        303⤵
        
        PID:616
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5996.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcCB2BE5F5F684F86AEF7335FCB3141A.TMP"
        304⤵
        
        PID:4588
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        303⤵
        
        PID:5844
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\nl4cuamc.cmdline"
        304⤵
        
        PID:3516
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5B6B.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc43464C63ED64856931667D091148D2A.TMP"
        305⤵
        
        PID:3596
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        304⤵
        
        PID:3920
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\dd46-0nm.cmdline"
        305⤵
        
        PID:2532
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5DFB.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcADEE2FE0678044FD8F85E75E936483FC.TMP"
        306⤵
        
        PID:3948
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        305⤵
        
        PID:2416
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\w5mad-sc.cmdline"
        306⤵
        
        PID:2756
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5FEF.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc95858C328A04D7194F58FE19BA6266.TMP"
        307⤵
        
        PID:4588
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        306⤵
        
        PID:5880
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\dujfaunj.cmdline"
        307⤵
        
        PID:3596
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES61F3.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc26A6B95738BC4F3EA2EFCE4284ABEE5.TMP"
        308⤵
        
        PID:1896
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.MSIL.Agent.qgg.exe
        307⤵
        
        PID:4664

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2qozwp-l.cmdline

Path C:\Users\Admin\AppData\Local\Temp\2qozwp-l.cmdline
Size 138B
SHA256 3ff158037ffa4eb0dd1aad40b14d8146c209fcf74d24fe22e541085db3917b51
MD5 8b23d657c411402bb1cfa81dff53070d
SHA1 63ee55d37ab5b916899c2bac091a543293e865e3
SHA512 d70b7c1e7a55a2dc603c7e214fd82d657110898f3b71b3d33e5389ec2d5379c32055f6d24021231d213f648b756428eb775808f681f63a653124309094151b90
TLSH
T1C3C09B0152CFC61916C7511B5DF5519C80B55E093F4D3F20D660C96F5243509FA83305
MD5 SHA1 SHA512 TLSH

Submit Download

2qozwp-l.dll

Path C:\Users\Admin\AppData\Local\Temp\2qozwp-l.dll
Size 1.6MB
SHA256 14b12e775086b71fc65661ce2e47df99ed72386b4c9462dcf0fcfc84597b2473
MD5 df597f9270dcca4e17af0ca3290cb7df
SHA1 ea2a090012a41cb00cf3537af028fbea2be3e192
SHA512 b9b86c74c8ad81a5cd46bfe440bcdf0c45ede2325a0fd7a3d83bf0ef1bf064f0471a263b307c8b30eaf5436429b15950003bf12983240ae698bbf8c87a59e6b6
SSDEEP 24576:x1fuQj+YSWPKPa73BaByndTPB3vkM62h7ox08l6h9Jl8+w8q8fP1kv:x1fuQoWPP73BPZl7JVly8Rn1c
TLSH
T18C85F8342DEA102AF173AFBD9BE475AAE91EBBA33707586D1072038A4713942DDC153D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2upjjuml.cmdline

Path C:\Users\Admin\AppData\Local\Temp\2upjjuml.cmdline
Size 138B
SHA256 6d24f97a1767b54eaae6ee1a1708a3c72a9264c1f4e0c60fe373ffd480b4a7ce
MD5 950f7102adc2c9687fcd5de38e230371
SHA1 366ba60d2c402d102c0971b79d544762fddc3cf1
SHA512 42434e813cdf01f2e0b0a55f582bf5071c5b683ba96ee449592498f22ef42c3df7da6df2309718bd753e7ee7c53da5e421c92bd67a6000566ff7356f5e2fea81
TLSH
T13BC04C0542CAC6595A8A602BD9E551AC84A1BE092E453B205650C95D1342809EA82219
MD5 SHA1 SHA512 TLSH

Submit Download

2upjjuml.dll

Path C:\Users\Admin\AppData\Local\Temp\2upjjuml.dll
Size 1.6MB
SHA256 ff686e316e324bd4b650d4e9a6b072ef7e984de078ed991f86130b7c6fd06599
MD5 3ed0ef709ec494d104e288fccc851a5a
SHA1 acc0765769811f5609e5418a1b8c5fd581992596
SHA512 33886ed33a26b809c00346b355a139ea2016fdb264223e27a0c30337145dbaa1179239da82146feab26d2d606d55d68e6dd46fdacfaa4664cd72cd44d97f0ff4
SSDEEP 24576:r1fuQj+YSWPKPa73BaByndTPB3vkM62h7ox08l6h9Jl8+w8q8fP1kv:r1fuQoWPP73BPZl7JVly8Rn1c
TLSH
T1CA85F8342DEA102AF173AFBD9BE475AAE91EBBA33707586D1072038A4713942DDC153D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RES1EC9.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES1EC9.tmp
Size 1KB
SHA256 7fc815977841739fa525426c2e772f3d81fa943ab102b0fd2fd5de50ff1e70db
MD5 d45755c8037900fc46cd47d6dfccca6c
SHA1 47b5ad89f50ed31896c0eb95c41eff0e1e623a2a
SHA512 ed91d3e19645175a70a8e9b6735e52a4437207956f02cb8598801de8f714568c64b3d3cd68a211901cf48915529d9779757d67776d37e0022ce6e3ca11fecec3
TLSH
T1CF21590563E8470EF0B75B3269F6132BA238FDA5DFB2A36F854012291C61504EEB1A72
MD5 SHA1 SHA512 TLSH

Submit Download

RES2503.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES2503.tmp
Size 1KB
SHA256 61bee6cdfed61f46bd1869bd3c87983f40d9cdd4d1bc18d7737a9b720d1aa29c
MD5 b26eb1ddecab6a482651312a7b12538a
SHA1 c3f62306e3395fdfc60e3bf5d6a4c05a46a4b000
SHA512 d53fadbe5f5ebffb0774174be5d5ca30919b4bd7a853977a316accbdd88f25aa37a7c6806d6bf514546ab0681286f53fe73e545b28d3a41537bea0eda6d32822
TLSH
T10E213D0563F8470BF0B7473269F5132BA238FDA4DFB293AE848402291C51504EEA1A73
MD5 SHA1 SHA512 TLSH

Submit Download

RES38BA.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES38BA.tmp
Size 1KB
SHA256 8236755ddf77515218fb29b6a31635af3e3a610e295a955b41932d586b134e0c
MD5 dc1a117c4edcad72edd4d17aee777e8e
SHA1 de697bc8059030ddb2d6dd6f27bc62ca9ce9ba15
SHA512 94db992806e096524f20e25150877c9c7ee209cb6673e128b2b68316e355547607b71947612e788d3c25bee331134e4b3276e4883aa93cd87fcfc719e546150f
TLSH
T181213A0553E8470EF0B74731A9F6132B9669FD64DFB293EF458012292C51540EEB1E72
MD5 SHA1 SHA512 TLSH

Submit Download

RES3C15.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES3C15.tmp
Size 1KB
SHA256 b6fff933596335c2f7a4ebf7f46a8116b405bd517726b03a380c5821db87f316
MD5 e0e100707e446c4ef4ed25c58ae68a6c
SHA1 6ab34576c24ca32cfc715f24401add35a411751d
SHA512 eeb1c462b0debbbb3c3ba710d5a2f68bfd142e5a831a2c58573e629cb647e49ff39b63d046a98c80118bdc07bb9e96db3e7abbb5cb5aee3b563d1ce040efcbf4
TLSH
T191213A0593F8470EF0774732ADF6532BA239FDA4DFA2939A858002692C51244EEB1E73
MD5 SHA1 SHA512 TLSH

Submit Download

RES3EF3.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES3EF3.tmp
Size 1KB
SHA256 646a98ae6807860a4a94ec36f11b9f3d75f05398075346e97d8b2bc167f6f8de
MD5 19a9d23e897df39862bd47964e48b4d2
SHA1 f12d802c863e47bf0699b769bbdb1993af8e9039
SHA512 ab97ae14f54e67ce52ead55b9aed6f99b007901c7dd053e28dbda3ce7df5a1799b95abb636388227565b0d87c941be410eb41dde031b467c074415dad253fceb
TLSH
T16F213A0653E9470EF0730B3279F6132F9675FE94DFB2935B854003292C51654EEB1A72
MD5 SHA1 SHA512 TLSH

Submit Download

RES41C2.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES41C2.tmp
Size 1KB
SHA256 093fabdae691d50515625cd3da56ae85229e8cb1f18e5f98cf51b3ee1c2db5e3
MD5 b6126b81a8b1edb9da14459485e3a40d
SHA1 c79f55adfb758a9566fb76b15a790918b309a84d
SHA512 0e0b86f6ead4da89cef585998b54ae183d8890c7060c4afea568b40c359376a1510635ac8f423afb384a7fa31c82f29ccf0d952dc447c007c5834b59f27d051e
TLSH
T1DA213A0593ED470AF0734732A9F6532B9678FEA4DFB2635A854003291C61104EEB1A72
MD5 SHA1 SHA512 TLSH

Submit Download

RES452D.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES452D.tmp
Size 1KB
SHA256 38c688ab999b1cbe4d1766180c9fbabe7ab138a02de05d11ef89c64c83229c76
MD5 69280cd92d6eda79c6ac542b23524e3c
SHA1 1716fbe365e8e5ecc46c6fb2f214a809d51b1b94
SHA512 2563f2febb66ad6feff392220746e9840bbb8c3d3e95fb4a3f0bd9340458fae8ca39daddd3aa971516e2fa28c5840980f7cd3d99352da0911f68151fbb479254
TLSH
T18D219C0553E8470EF0B347326AF6132BA628FD64DFB2A35F848042292C51544EEB0E72
MD5 SHA1 SHA512 TLSH

Submit Download

RES47EC.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES47EC.tmp
Size 1KB
SHA256 e26ba8ce1d8d93fb922505e20175e9d18d729678c5144c20b22ebd50f94664e0
MD5 9ab167da01b4fd3fc3f53aec2d11bb7c
SHA1 478b5121fd29fa7b2670e765ebc0c23c49c28995
SHA512 72fe52c6aaa2229aaa57a2b3c7068fa5d0d3a2a080c998b6015bc9c87a370bd610f73fb33bdf859652730d9ea08d341947ce46e7c7cab3b716db88e6f6cf4056
TLSH
T124213D0553E8470AF0B70B31A9F6632B9664FE64DFB2935E844042281C52504EEB0E72
MD5 SHA1 SHA512 TLSH

Submit Download

RES4ACB.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES4ACB.tmp
Size 1KB
SHA256 32dd755e4cec0de8c5d150f92e2e46e53fd872549322aca8c5a56e5e607df88a
MD5 0b0e60147c1ccefcd8af4ba48981a09f
SHA1 ad515ea2f819ac7c7cd352f0ce5ae48dd4a59744
SHA512 2f2003477c0894c64acec879f4262a694891e2874383f1af397191d39516b83164a2ddddf3335b76745c98dd472edce1d4591325e6b29895f05bbd6f229420c3
TLSH
T116213A0553F8470AF0B74732B9F6132BA278FDA4DFB6A79B858402282C51144EEB1E72
MD5 SHA1 SHA512 TLSH

Submit Download

RES4CFD.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES4CFD.tmp
Size 1KB
SHA256 466bfc6e016dfd659daa7f8e10cd5a47938209754599ce0ab319ba992fd79cf0
MD5 9d73b508647a543212022e416db33bd9
SHA1 9404c63c152c3b507ec041c2d0f92a14e39a6369
SHA512 69a29fdb2b742999323213591021b07d66c3de74db068012cba3861b1a68fc781d37a8645e7e8a555df54f62399b68f5ce52f28b191861f61d362c171415611f
TLSH
T1E8213D0653E8470AF0774732A9F6132B9239FD65DFB2E35B944003291C51140EEA1A72
MD5 SHA1 SHA512 TLSH

Submit Download

RES4F7E.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES4F7E.tmp
Size 1KB
SHA256 67263e77e40b17d277ab64d04fb8e4ede3e5d41875a33e1f18ade4e6eb231b5e
MD5 f0b7b1a9aaa3e963a38e6d7c60a646f0
SHA1 cb457ab8900ffa9a78e54e14c3e295fa588377ba
SHA512 06eda7190327fda557997dd8fd5158df17047011edd01fb8586a6ba5ea37c501cffad70de06ddaa3edba94fd790c8ed6f1f1209dfd627e645639935f5b2fa7c0
TLSH
T18421230553E8470AF0B34732B9F6132BA629FDA0DFB2A35A8550022C2C61540EEB2A72
MD5 SHA1 SHA512 TLSH

Submit Download

RES51C0.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES51C0.tmp
Size 1KB
SHA256 8c4b9326e3a6d26484295a4b6dc721771f8fa0647943efa650f6a7f82183a7c9
MD5 74d7485671d5e4aa343def6680551fd2
SHA1 d421663b2791aae37e8abdb826b76eacd820cec9
SHA512 8a630ed216638343f6b74c49f08832ca6ffd33d96b5d37fab5a6cd9a485987f4ce824e2ddb2dae4d720e9a456ad32f295e4c4e6381aa655d1c00c4287e22e71a
TLSH
T15F210A4553E8870EF0B74731B9F5272BA279FEA4DFB6A39B858002291C51504EEB1E72
MD5 SHA1 SHA512 TLSH

Submit Download

RES54BD.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES54BD.tmp
Size 1KB
SHA256 a2ed9cb57ae61f6b5ec87775e5dc6635f5249d6dfd9ed3bc40e87ac453a77968
MD5 a02568fa6d8668f811f5ebe4bf6a5a42
SHA1 cbd30a13aaa169dc3ecaffec55fe7b243bf926f2
SHA512 2880c8743d360e65f17acf3ebd42b86015ab10f94aad028b458f2cd8a9f08690056f8dac8721663d37d5492a7ff73f3107c82a823a199edc3b2cf6a305a4b99c
TLSH
T1DF210A0653E8470AF0B7473169F6231F9228FEA4DFB6A35F8580026D1C61554EEA1A76
MD5 SHA1 SHA512 TLSH

Submit Download

aiidrsle.0.vb

Path C:\Users\Admin\AppData\Local\Temp\aiidrsle.0.vb
Size 829KB
SHA256 3d18afa77efeef0367ca8677d1a286ecfe2aa55dcc4b54d3cf156ff3bc60bdc1
MD5 0ef3b6f6f068f5c28f21d555494201b6
SHA1 894045317dae93130b791121479f1379fa91b316
SHA512 9fc01cc152b4a00b746c65cb2506cd4d2ef34a6afb59464c0e8fcd62ba027826af84e3b16ebbf811e3cc689c10500e387c89d3e8723e3bcfcfefbb2c4783acb9
SSDEEP 12288:uUc8/90IbsvVuUlf+clnpWmzb9/4xAglnz+KWUjT7fq4y4olO+/8i6yGpnth:ukQNuKIAgpzfWUO1J/8iLUnth
TLSH
T1150523304952982D0ADD0A0A10FE6E2B5CF85DC7A8D4F1F4F25D39E9A7B47B0A0BD6D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aiidrsle.cmdline

Path C:\Users\Admin\AppData\Local\Temp\aiidrsle.cmdline
Size 138B
SHA256 93fdc29bbc76e3ba2c19046715b7b37748d40e218bf535b5f5ded73b1ca07b65
MD5 3aeb3a8950113d7b1d8ced263c92999c
SHA1 34dbf71cda7f060ff0727bdc55eaaa2f4d512481
SHA512 da0a71bf8bc9bb57f6a063bf4c7ba17cffe2020f1ded894531100143164fb49d5a303b992150065912e5dccf2abc0bee0848d66cfb685f16ffad45d23f65f134
TLSH
T18FC09B11468FDA1935D5707F55F5519C80F1DD093E853F558650C55D1343919BEC6301
MD5 SHA1 SHA512 TLSH

Submit Download

aiidrsle.dll

Path C:\Users\Admin\AppData\Local\Temp\aiidrsle.dll
Size 1.6MB
SHA256 55baaccce5d0518f83fd5717fc0b40455d18ef69238e0e5a3bc89f06ddcf1591
MD5 13bb3a3ec8c1c1cdf87df846dbef414e
SHA1 85a9833c838eb14c4ea1dcb2c85c8edb883c9c98
SHA512 0a6ba39d8826e233759cc34215a6a4395e6a9d68179a3eae96517bf59e0547858f3c2c2c80982626478a0e84bbfc21a958554c86361527c4d7196f61c87cc13e
SSDEEP 24576:E1fuQj+YSWPKPa73BaByndTPB3vkM62h7ox08l6h9Jl8+w8q8fP1kv:E1fuQoWPP73BPZl7JVly8Rn1c
TLSH
T14185F8342DEA102AF173AFBD9BE475AAE91EBBA33707586D1072038A4713942DDC153D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c8hq-qti.cmdline

Path C:\Users\Admin\AppData\Local\Temp\c8hq-qti.cmdline
Size 138B
SHA256 e223004c51f9a85553385ccb68b11b7a4e1da387ba27c2075edec3f3dcd370f3
MD5 d53bd11a3ad7c1a017a0af912c19afc4
SHA1 b4d3eb60a856034aa328a1a73a7bbba876a4c839
SHA512 c992c397d28866f7b7b9e1cdb9172225c10e4bcc4b7854faf5517fc09df498d53024fef35374543edbf1472a7c734f314eadb298667f5b920c7e58bb03c5f350
TLSH
T188C02B050287C3280CD5F01B15F650BDC0F55C093E893F300F20CD6D120300CB692340
MD5 SHA1 SHA512 TLSH

Submit Download

c8hq-qti.dll

Path C:\Users\Admin\AppData\Local\Temp\c8hq-qti.dll
Size 1.6MB
SHA256 2a282edea8a90aee46b15834f1da53c199a5846bf8f8913f230dc594637e96f8
MD5 bdbf5e807ac9dfb6a4fd673a8e92d653
SHA1 a7f257f208abfec59c16cb71c60b293c5040c85c
SHA512 a412db25541ba4680b901e345d3c7eb9cb1efab1d51913519fa9ec5d8f908aac8e0829ffe54f962dd4ee3b907a4c9a46ee987cc3cf8dcc2332abbda308a91c0c
SSDEEP 24576:u1fuQj+YSWPKPa73BaByndTPB3vkM62h7ox08l6h9Jl8+w8q8fP1kv:u1fuQoWPP73BPZl7JVly8Rn1c
TLSH
T18685F8342DEA102AF173AFBD9BE475AAE91EBBA33707586D1072038A4713942DDC153D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eimpaakc.cmdline

Path C:\Users\Admin\AppData\Local\Temp\eimpaakc.cmdline
Size 138B
SHA256 ea212f2ead1b1e51637ab7021684fdcd982869b1f769ac4c0e59c5a42ed7ece3
MD5 2ea57ddcae34387081cb24770f2d6eef
SHA1 98e49444e88babd4e005fe9f12ae5502299d0bc4
SHA512 d8245b0c9949ae82b6228d3768059aa60859ef070fdbb29b40d709ddfebbcb5dbe409ac36ca8b8fae5f4a8e8d49b0812d8cefdd33d513f155544ffc0ab78a1c3
TLSH
T1E6C04C014286C6192589742F66B562AC80E1EE1A3A553B20D750885E1253509B693691
MD5 SHA1 SHA512 TLSH

Submit Download

eimpaakc.dll

Path C:\Users\Admin\AppData\Local\Temp\eimpaakc.dll
Size 1.6MB
SHA256 8ba9fd4445df187f4ccb74888eb82484645c7cb80e58291f407d198e183bb49c
MD5 69f79599e6c086b074dc5a416fa20129
SHA1 3af0c6e9b558ba6d49d5aa09f8207695a32d463d
SHA512 3c20f087ef0234c9262d5b615fc068c46057d87c74778a14461f51ff660d3c2fab364da2b6492dfb232aae7dae917ca2fba3e10078e3282e4f287815c63e5168
SSDEEP 24576:x1fuQj+YSWPKPa73BaByndTPB3vkM62h7ox08l6h9Jl8+w8q8fP1kv:x1fuQoWPP73BPZl7JVly8Rn1c
TLSH
T1A385F8342DEA102AF173AFBD9BE475AAE91EBBA33707586D1072038A4713942DDC153D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eozurlap.cmdline

Path C:\Users\Admin\AppData\Local\Temp\eozurlap.cmdline
Size 138B
SHA256 e877c86240a141c95e7011b50001770c792d17d90143375589c422f52fa52fc0
MD5 44b02f54be18d74fd602907597215bcb
SHA1 8b8f346e94c3656a517524cdd7f665ae6a9aa6be
SHA512 eb332ff93ddff1c2a2d6db950b65d95ce6b6bf497cbde5ae5f0ea6bf9bdf99e9c1cdcbd838cccd14d76df7a2affda2fbdcf0bf3e43dba94182c17c43010054e3
TLSH
T19DC09B018287C61FE6C5501B65F5D59C80F35D093E457F144650C75D1283409FE92305
MD5 SHA1 SHA512 TLSH

Submit Download

eozurlap.dll

Path C:\Users\Admin\AppData\Local\Temp\eozurlap.dll
Size 1.6MB
SHA256 e1cf5feab952689ef977dc50ea7a357142a7d95acfc02a4307d7d2ff9d71166f
MD5 714ec280dd55f7eb9c65e360c5ad8429
SHA1 51023ffeeea1ecdbb4cf07c89b35501dae7c24b7
SHA512 6d93b83383d09ba19bc770bf2aa86d1bcf39029f7bfdddf1e4a4334ba3b94b6994b9e4f716e2bc0956680ccc29e2074d47e9eb9bcbd1027f8bf8aed40323c68d
SSDEEP 24576:51fuQj+YSWPKPa73BaByndTPB3vkM62h7ox08l6h9Jl8+w8q8fP1kv:51fuQoWPP73BPZl7JVly8Rn1c
TLSH
T1B585F8342DEA102AF173AFBD9BE475AAE91EBBA33707586D1072038A4713942DDC153D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

htlrzpq_.cmdline

Path C:\Users\Admin\AppData\Local\Temp\htlrzpq_.cmdline
Size 138B
SHA256 da66e01a97a398a4788578108d2f27318f9f6c3c8c97a22f97a3ea26041d894d
MD5 25e558b4429161674366b622ec9a005f
SHA1 08051498db8f987d7f82c873b6c04974820e4ee3
SHA512 90bbd9a9ec43677b23dcaf02662421784aef152ce9e91042f027e323a33114f45b1b9c9594a8057de01d89f13f6eecb8158bc6c8e780eb6c91625b3655c97399
TLSH
T139C09B0682C7C61A19C7D05B7DF6519C90B2DE093F493F109A90CC5F1693419B6D2302
MD5 SHA1 SHA512 TLSH

Submit Download

iiyapacw.cmdline

Path C:\Users\Admin\AppData\Local\Temp\iiyapacw.cmdline
Size 138B
SHA256 d8eaa2595a0068437f1e334772214b6ee30c84068952bbdc3f817e084cc1ce81
MD5 21576f0be9711ce71feecbf56d1fce66
SHA1 57fd29fea3c2b2d352e2572bf3dfd0aa1af632a6
SHA512 ad91a15f7af5bcd2bc872980ef5cac9db1b79a06e99c352968729ef2c719cc1d5eebd174f70542c0140e83470d7593d0c41f2b86ca95fec700b187236f12b6a4
TLSH
T192C09B014287D71916D5741B55F5519C89B15D4F3E453F10C754D46D1253819B683341
MD5 SHA1 SHA512 TLSH

Submit Download

iiyapacw.dll

Path C:\Users\Admin\AppData\Local\Temp\iiyapacw.dll
Size 1.6MB
SHA256 639ed748ffecb370c5aaecdf6236d0275a1628b871261e7988985bb6f2a668b0
MD5 1c99d6424432632e4b9756d01233f673
SHA1 79c2730f29c937cc07e8e0ab5ff136c1045b1a40
SHA512 24600d874fdea18ba5c63d39b093e37da41f58e1bc4993cc32e306a176a4162fb74a96c55890edfc41d3350a2f79dba339ec53751e09462b722f02724bf0b32a
SSDEEP 24576:j1fuQj+YSWPKPa73BaByndTPB3vkM62h7ox08l6h9Jl8+w8q8fP1kv:j1fuQoWPP73BPZl7JVly8Rn1c
TLSH
T10985F8342DEA102AF173AFBD9BE475AAE91EBBA33707586D1072038A4713942DDC153D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

iofyzdp_.cmdline

Path C:\Users\Admin\AppData\Local\Temp\iofyzdp_.cmdline
Size 138B
SHA256 30c0197d2d8b27971154595bb66fefd876ec25ae8c973a719fbfe06aa0517e85
MD5 d436821c3bf531a8ce0f952e8b3a322a
SHA1 23273ab24173edff62acf6034f0687e254c29fda
SHA512 1356f0d06d1b62b95458c24e0530b17cd05b0aa4d95d4cdddd4b80352926145bf2ba7a3e7d1bfc6082c0e3baa3025459d6738f108932491e1f8776286bcd051f
TLSH
T107C09B068297C61A16C5513B59FDF1DC84F35E493E453F304A50C55D1283419BE83302
MD5 SHA1 SHA512 TLSH

Submit Download

iofyzdp_.dll

Path C:\Users\Admin\AppData\Local\Temp\iofyzdp_.dll
Size 1.6MB
SHA256 d1865a1f3640f857b72fccefbf3cfedbf9ba4dd0585402ac1d657756727a4e67
MD5 00d6014230b288fc4e59933f57599dc7
SHA1 67e7bf6ab6d5e8749b79433264baaa454d436e1c
SHA512 dba39b0f460f041ff61a2c7dd932187b7d1652d40cc6c2cd3ae4f861bf2b79a6784c4473931cef2497bedfb8116e2448504ec25d880ff402f2abe81c79359ebc
SSDEEP 24576:z1fuQj+YSWPKPa73BaByndTPB3vkM62h7ox08l6h9Jl8+w8q8fP1kv:z1fuQoWPP73BPZl7JVly8Rn1c
TLSH
T1D685F8342DEA102AF173AFBD9BE475AAE91EBBA33707586D1072038A4713942DDC153D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lqgpfuwd.cmdline

Path C:\Users\Admin\AppData\Local\Temp\lqgpfuwd.cmdline
Size 138B
SHA256 c2a61e1d7883719602345872ca5b5b9946142c85c58fd44538f5fd8463995791
MD5 008d30720baa977e5878ad1547df4781
SHA1 34637ce43379c392524b2120f11e1920cf015806
SHA512 37dc6ce67912dac9aaf44a4ee73494261f24dfd9fd422ecc73aa757e6352e90263b5edc1aa5734d67bfde6f3cdd14aa9485a30e7b2894436d8de9ab6f6327b5a
TLSH
T1C3C04C014686CB2A2985621BD9BD51DDC0A16D496B453B104E64C49E2342489A69A611
MD5 SHA1 SHA512 TLSH

Submit Download

lqgpfuwd.dll

Path C:\Users\Admin\AppData\Local\Temp\lqgpfuwd.dll
Size 1.6MB
SHA256 8862cff7a4945c3e37369634ad1da61c4ec82fb87163aca922a8e21cd9c43af0
MD5 4488ba6fcafd576e0fa591a660768244
SHA1 a62c835af52b71ee7127cc64f6c37b3085bebaef
SHA512 c58a389b7e6080ba5573c1a5ddbc06c37d501f46a914d34e3b2843a45cd4133ebe0a0eff60b65abdb94e2e5c07954560e05a544a210989a9ea3e60af557c031d
SSDEEP 24576:71fuQj+YSWPKPa73BaByndTPB3vkM62h7ox08l6h9Jl8+w8q8fP1kv:71fuQoWPP73BPZl7JVly8Rn1c
TLSH
T18085F8342DEA102AF173AFBD9BE475AAE91EBBA33707586D1072038A4713942DDC153D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vbc1DC8BF2D8AA54779922BB419155F3685.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbc1DC8BF2D8AA54779922BB419155F3685.TMP
Size 652B
SHA256 91efc65bc449d813a697710f77cd42247598a359c89d2c67c91a3377a51ff1e6
MD5 95cf4ce646644dbd26cfde8cc44f796d
SHA1 c7027a5379d47eeb0708205d103efbeaca6b695d
SHA512 fd453a981517bb2208eb1b10081cdbdca03bc5f2538f0a268e437816f3a666a8fb02a9b0e7c40f1a4cb1aeb1501a8ad28a740e1f2ced5ff12387719216ba190d
TLSH
T10AF05E8963F8920EF1F34B30BDF6536391A9BC65DE3293ED148003196C646109972FB2
MD5 SHA1 SHA512 TLSH

Submit Download

vbc330223E7C3834ECCAC5DA64CD32B596.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbc330223E7C3834ECCAC5DA64CD32B596.TMP
Size 652B
SHA256 3538e812f0d72108d10a4ecc3e853f50126d8afac9160b68936d66b090daee73
MD5 4a8934173ac26c944aabd0e53afcc975
SHA1 7999132eb9c0f109be41f75bd56f5b280a96f204
SHA512 4597ed25cbf2af530fb36157ca285ee500dbe97fbe66333fa0a5511395c70cf5a237ea8c35324ae339c8cf27f2e4361deb21ab32a6652292da8553028e7ab5ae
TLSH
T1E9F05E0963F8420EF4F35B31BDF6436391A8BCA5DE7293ED1440031D2C646108972FB2
MD5 SHA1 SHA512 TLSH

Submit Download

vbc3D2A817223F949568A861B339CDCD66.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbc3D2A817223F949568A861B339CDCD66.TMP
Size 652B
SHA256 ee96659baa4e6fe3a3677180c50cf04db344dc1d6ee43e093687a2faff0973c6
MD5 eb9344b481bccdfcd724c9f9e0e1b4a4
SHA1 b9729c42be081e2f3daf8559f45d173a42196d5e
SHA512 ef80ecc2379c64ba6b31673da1078c066c05fc07f82cb3f2ba1ead9c1f8f54197af024d82d94f37eb717ab81af66c20539faba602546ce2aa7f0f9b668201748
TLSH
T16CF05E0963F8020EF0F34B71BEF643A3A5A8BC65DE72A3ED1440131928649108962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

vbc4A689AD28A4D4F8788FF841AC0CCA661.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbc4A689AD28A4D4F8788FF841AC0CCA661.TMP
Size 652B
SHA256 1df3c16403bf612962126ad4ec3864c0881ec760cb9b634f6d5cb6d533cb2f83
MD5 81ab179cb81e5987ddf8532dde6c44df
SHA1 c5d87c1835962237e166a01ef0216092e59dc90f
SHA512 26a0219577b56216e1bde48de03cda73dbdf2f87f3800b130cab80423b8d55275571f11fdda307ddd14e33a1cf3d6c5dab758b11f2f51895073d9150a7d084ef
TLSH
T183F05E09A3F8020EF0F34B70BDF6836795A9BC65DE3293ED5580031928646108A72FB2
MD5 SHA1 SHA512 TLSH

Submit Download

vbc7859E112912C44ABBCF895347CB13E62.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbc7859E112912C44ABBCF895347CB13E62.TMP
Size 652B
SHA256 c513aa61dc4c29ab0d2f59ef5894e0bd340b1de182405b6f4ed456a6838a653d
MD5 81804ab3f1d4cfc629a19e28520c74c8
SHA1 0fcfd6468713073c43ba35418fad769618ec0cb3
SHA512 a7ab56395eabc41e0f39e59c53afd6a1de337ac2caa307574a123d7c34eb524aeeff906af78a538babc9abba6d572c96c4a0f19d2cfcefffe2f8a3dff0d3c9f9
TLSH
T115F05E5963F8120EF0F35B30BDF64367A5A9BC65DE7293ED2850035D2864A108972FB2
MD5 SHA1 SHA512 TLSH

Submit Download

vbc846B69E8BB64B0E8EAA48DCFF2EF2.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbc846B69E8BB64B0E8EAA48DCFF2EF2.TMP
Size 652B
SHA256 2113245349eb1557f1c1ea0bc0f53d9e05d752f2adc3c33c78d4596cde80eb48
MD5 888470b9f47a942cad8e0acd4363365e
SHA1 ae409db4c1889061ece77315935ce7e93008d1e2
SHA512 ce9c3eed656ed71ce8d143792fe15d11d1145247b0421625c7c186b988e5c941a1cc9d62df4be956ac639f2d7ae118cf373297501a8496684fae06beacba923e
TLSH
T195F05E0A63F8420EF0F34B30BEF6536395A9BC64DE7293ED144013292864A108962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

vbc90054E65801A4CB9BACF16F6BF3AA716.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbc90054E65801A4CB9BACF16F6BF3AA716.TMP
Size 652B
SHA256 72d0f2dcf7efb95ee0627c0139ee3de8e35077fe4d6e91b6a0da9b15e38bd4e5
MD5 7dffed8a0ea13b80b2e05fe76c1f0fc8
SHA1 ef746ff109997b54e1b4bcac066182154dd1726c
SHA512 7feb77ccd60008695b3e1494038484d5114306367553f5afde144208933bead0598c7ab25eb1cba036fc388cda7bbb68024efa469c42bf4a8394d4359b0524b7
TLSH
T1CEF05E0963F8520EF0F34B30BEF643A791A9BC64DE3293ED194013192C646108972FB2
MD5 SHA1 SHA512 TLSH

Submit Download

vbcA2E395402B1544C69F6087B543C8D5A.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbcA2E395402B1544C69F6087B543C8D5A.TMP
Size 652B
SHA256 6764bb7eb2bdc229da2a6eb04e0d41ac51036b0ef5b3c84c27d9fcedea252e70
MD5 eac363f22a80ccedccba4e04354da17d
SHA1 6c34ed8542261d5fed1c193c956e7b5bfdf6f08f
SHA512 403482ffebd81277a41c16de4c1998b38b9312f27b686288a868967783ae69e56524198c5382085372c15adaf4a46ba6274890ac7fe9679d59828db14d7fda70
TLSH
T1E8F05E0963F8020EF1F34B71BEF643A391AEBC75DE32E3ED6480031928645109962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

vbcBDEC1BDAF13C4066859D5BF16B1712EF.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbcBDEC1BDAF13C4066859D5BF16B1712EF.TMP
Size 652B
SHA256 70cdee66593c4813c3ee71110a9bf2174da88cd37f9489b990a79546565267e7
MD5 b08c8b1d37f711f6deb1d8b3f34b8525
SHA1 7c29f9c023b618e191951affe9e1f53229566ac6
SHA512 7a20fad5fe54f9095ecbeee8ea0ed4f977ba483b613f56e23a48255781bb1ac4f84a5ecb5cfe83c7f45ae3b2d8ca78080422883b5c0f2bd9a3b4052bf93f51ae
TLSH
T12EF05E0963F8420EF0F34B30BEF6536391A9BC64DE3293ED5480032928645109962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

vbcC8E63CC6B3E844219730F976F1FF45E4.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbcC8E63CC6B3E844219730F976F1FF45E4.TMP
Size 652B
SHA256 1158f9f1bd027599a790e6bbb180c2d9a3fcf5f95a8d993fad746cf70c275fe4
MD5 ca2dff15fb41fb0c82efb1213fd523d8
SHA1 08231908c4f6b13d313a1155447b852c05089580
SHA512 90f412ede0624f1cac0f87b0b666553ea93ee90bda5a8864e8fe885ed89dde276073049c5e29f4570ba553994e50f6f8aa375532a4ca774d604ad5dcf89480f1
TLSH
T126F05E4A63F8120EF0F35B30BDF64367A1A8BC65DE32A3ED144013192C746248972FB2
MD5 SHA1 SHA512 TLSH

Submit Download

vbcD80D5913E2AD4C53814BA0ED3A6F9887.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbcD80D5913E2AD4C53814BA0ED3A6F9887.TMP
Size 652B
SHA256 d10f32b9a5360df6e9ac1804456928eef27e3ac6e5dd5eb2b97693a63defa42f
MD5 1522d4145da9475f676efd0b50c3a81c
SHA1 76aa9a6490bf8f349dd5966c69092473bc49fb32
SHA512 4ec0dad92e2d72c9d66479541f8d92a38f36ee4f6583838bc4c40bcb38808c515626ee72d23c88663fabaf8a6e244b3935a4b8fa9329ed613e8b025bf6c0c948
TLSH
T1CBF05E0A63F8520EF0F74B30BDF64363A1A8BC64DE3293ED248403592C646108A62FB2
MD5 SHA1 SHA512 TLSH

Submit Download

vbcF4598E736C3F4384ADC66EE793DD1FA8.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbcF4598E736C3F4384ADC66EE793DD1FA8.TMP
Size 652B
SHA256 34b508ef1047a345a779b404c9d61434297e6897cd2cc0c20d4f9f2377e6569a
MD5 a1eb2626ef99da4c7e9d1b8dbc9a5aa4
SHA1 2ee382bd53cb1607ada374516681941a9ec4bae5
SHA512 15b7bfb25defec65188687296bae54b901f2c4844069ad1bd4f4f5912926a96ebf09f301f582d18bfd7dac154adc2fff0ad20da5190d21a3225679e2856b68b1
TLSH
T18DF03A0963F8520AF0F34B70BDF653A791A8BDA4DE7293ED1440031D2C745108962FB6
MD5 SHA1 SHA512 TLSH

Submit Download

vbcF86442D25DF4D018FEBB09F1155D881.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbcF86442D25DF4D018FEBB09F1155D881.TMP
Size 652B
SHA256 8b9837b6b003b5580c85a5e2bd90bb37528aa921f3e2c6175786661a6a763718
MD5 cc66a6d31e7ddf9ed2e21f0a504fbbfe
SHA1 969313fcff970bd430c300289b0a44e0437ac411
SHA512 6a6f3fad96f03cca344c6633ba9ffd4fe7686a2a49cf4bb10ddea3a40a375d9cc8fe5d08a5648859c5ac16f9511ff20d234e0a7772c165d4e4f1fc7104846729
TLSH
T1EDF05E0963F8420EF0F35F30BDF6A36395A8BD68DE3297ED1440131D28649148972FB2
MD5 SHA1 SHA512 TLSH

Submit Download

vlig8ujt.cmdline

Path C:\Users\Admin\AppData\Local\Temp\vlig8ujt.cmdline
Size 138B
SHA256 68b66a83e7be98afead46484d14c8c1478d79ecaab41cdc0ec02130a8ddaea30
MD5 df60c512a91d194d9624a49b025a1c1c
SHA1 92174417e97c31c1aa0f7ddd95c35c4499657286
SHA512 05bc0f6e567082bf70bc2bca3a4526447decfe5fbeecf4f73f7763462e7a71b51470b5d917a465755e85faaea19cc4e796736e569e00bd73c899a2fc4658cff6
TLSH
T1AFC09B0D828FC61A16C5501F57FD519D80B15D19BF553F314690CD5E1643459B782302
MD5 SHA1 SHA512 TLSH

Submit Download

vlig8ujt.dll

Path C:\Users\Admin\AppData\Local\Temp\vlig8ujt.dll
Size 1.6MB
SHA256 bcc0589d68565377c031813717661adbc4c6491a51822e6c48ea329abec4d707
MD5 d008acb496cbbf7b5db9b7607ba86a56
SHA1 0e1f7f08fb4497c996dbd0dbd1e0b79e84e13b34
SHA512 4ba1f318c19fc0d6db5bcc51a26b82911dc5c90e4b596d9e33f77f54e082cdb32cb449bc0bcb2a969c7bc09f513e21557ddc5dcd0d4c948be40691d099279f42
SSDEEP 24576:I1fuQj+YSWPKPa73BaByndTPB3vkM62h7ox08l6h9Jl8+w8q8fP1kv:I1fuQoWPP73BPZl7JVly8Rn1c
TLSH
T1E885F8342DEA102AF173AFBD9BE475AAE91EBBA33707586D1072038A4713942DDC153D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vzfjqmdx.cmdline

Path C:\Users\Admin\AppData\Local\Temp\vzfjqmdx.cmdline
Size 138B
SHA256 9210bd8eb612c464dc87b4bd37d8bb28454a695ef992b78f8cc3a2e7ef3b8c4d
MD5 0a636d2afcdcced2ba47d44760070e83
SHA1 dc38a82769c169bd76494560230f2304f0a9d6f2
SHA512 4ac70655ba3ee3366e99d434bddc8766b16c4ac9dbe60dbec4bb6b9fb26c2949ccc2112751c52b8e19a0826da62163f15651e1d15b4ffaae46c9dde67c16ce56
TLSH
T1E9C09B024287C61F16E5D01B55FE5DACC0F15D1D7F453F704A91C45D1243D09B686312
MD5 SHA1 SHA512 TLSH

Submit Download

vzfjqmdx.dll

Path C:\Users\Admin\AppData\Local\Temp\vzfjqmdx.dll
Size 1.6MB
SHA256 03e98a945f791a96f55eaf3c85863990426754e4407fba9b4d9df7d4d7a6ea0b
MD5 86754329e85b5c793c66789528d0dcbb
SHA1 c8ec342333f7bdc7736b6c70d1763252c060b06d
SHA512 a4136b973fad7fde3243f588a119498a4b493e40e158bb82d754911891fa6389b60d15c14131cd6d1e880c26d4a8bb6cc1801afa91dc3eba33df933383d4603f
SSDEEP 24576:61fuQj+YSWPKPa73BaByndTPB3vkM62h7ox08l6h9Jl8+w8q8fP1kv:61fuQoWPP73BPZl7JVly8Rn1c
TLSH
T1C585F8342DEA102AF173AFBD9BE475AAE91EBBA33707586D1072038A4713942DDC153D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ylgrobsd.cmdline

Path C:\Users\Admin\AppData\Local\Temp\ylgrobsd.cmdline
Size 138B
SHA256 8a67644a6bb2909b10ad53d0eaeea16dcfb0ee28d23388c305957b7ff15380a0
MD5 3bde7b4f9afeb6b92a0456b94ea861bc
SHA1 872fd9a0ab3d58af633c1580ed1f0fe5c27d599c
SHA512 c3db939c7d8c4f3c31cf6d295c4b244a5b8f2c324002bd3ba4b23cf1c638c50f8c8886aa3b47f6b8099f13d872260ef3aa9cdde7e1c0f8846ec7aca9ec8591fd
TLSH
T10FC04C02538AC62A15A9911F55A9919C80B15D0D2A457B114A5184AD1392409E68EA01
MD5 SHA1 SHA512 TLSH

Submit Download

ylgrobsd.dll

Path C:\Users\Admin\AppData\Local\Temp\ylgrobsd.dll
Size 1.6MB
SHA256 93b8239c51f143feaa5940268c205a34f03aedea0ba57d77af29a0b38e681e97
MD5 5c387b81310799aeb0f236ce683cbb90
SHA1 89539ef8176280f6d23a36e28955442efcec26d1
SHA512 bd57cac7e0f596e0548189328fdf2beed8a0cf3d4934bec87422fe18d08848ff6deb0a282ee6409b8f464b6f968dd94a6577fd6a4be30f3044a8e31430c21a24
SSDEEP 24576:a1fuQj+YSWPKPa73BaByndTPB3vkM62h7ox08l6h9Jl8+w8q8fP1kv:a1fuQoWPP73BPZl7JVly8Rn1c
TLSH
T1FE85F8342DEA102AF173AFBD9BE475AAE91EBBA33707586D1072038A4713942DDC153D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/264-255-0x000000001C200000-0x000000001C3A4000-memory.dmp

Download

memory/692-282-0x000000001C600000-0x000000001C7A4000-memory.dmp

Download

memory/900-570-0x000000001C330000-0x000000001C4D4000-memory.dmp

Download

memory/956-435-0x000000001C3A0000-0x000000001C544000-memory.dmp

Download

memory/1084-687-0x000000001C720000-0x000000001C8C4000-memory.dmp

Download

memory/1104-67-0x000000001CA20000-0x000000001CBC4000-memory.dmp

Download

memory/1132-822-0x000000001BE00000-0x000000001BFA4000-memory.dmp

Download

memory/1228-597-0x000000001BFB0000-0x000000001C154000-memory.dmp

Download

memory/1380-624-0x000000001C270000-0x000000001C414000-memory.dmp

Download

memory/1416-300-0x000000001C6E0000-0x000000001C884000-memory.dmp

Download

memory/1488-534-0x000000001CB40000-0x000000001CCE4000-memory.dmp

Download

memory/1500-363-0x000000001C5D0000-0x000000001C774000-memory.dmp

Download

memory/1580-498-0x000000001C850000-0x000000001C9F4000-memory.dmp

Download

memory/1616-642-0x000000001CD20000-0x000000001CEC4000-memory.dmp

Download

memory/1688-137-0x000000001CD50000-0x000000001CEF4000-memory.dmp

Download

memory/1716-309-0x000000001CAF0000-0x000000001CC94000-memory.dmp

Download

memory/1752-201-0x000000001C9F0000-0x000000001CB94000-memory.dmp

Download

memory/1808-678-0x000000001C650000-0x000000001C7F4000-memory.dmp

Download

memory/1836-179-0x000000001C8D0000-0x000000001CA74000-memory.dmp

Download

memory/1856-615-0x000000001C660000-0x000000001C804000-memory.dmp

Download

memory/1872-318-0x000000001CB10000-0x000000001CCB4000-memory.dmp

Download

memory/1880-151-0x000000001CB40000-0x000000001CCE4000-memory.dmp

Download

memory/1960-732-0x000000001C230000-0x000000001C3D4000-memory.dmp

Download

memory/2072-453-0x000000001C940000-0x000000001CAE4000-memory.dmp

Download

memory/2152-696-0x000000001C210000-0x000000001C3B4000-memory.dmp

Download

memory/2180-750-0x000000001C990000-0x000000001CB34000-memory.dmp

Download

memory/2504-471-0x000000001BE60000-0x000000001C004000-memory.dmp

Download

memory/2516-192-0x000000001BFF0000-0x000000001C194000-memory.dmp

Download

memory/2540-9-0x00007FF9CAC70000-0x00007FF9CB6A8000-memory.dmp

Download

memory/2540-5-0x00007FF9CAC70000-0x00007FF9CB6A8000-memory.dmp

Download

memory/2540-22-0x00007FF9CAC70000-0x00007FF9CB6A8000-memory.dmp

Download

memory/2540-21-0x000000001C870000-0x000000001CA14000-memory.dmp

Download

memory/2540-23-0x00007FF9CAC70000-0x00007FF9CB6A8000-memory.dmp

Download

memory/2540-20-0x00007FF9CAC70000-0x00007FF9CB6A8000-memory.dmp

Download

memory/2540-0-0x00007FF9CAF6A000-0x00007FF9CAF6B000-memory.dmp

Download

memory/2540-4-0x00007FF9CAC70000-0x00007FF9CB6A8000-memory.dmp

Download

memory/2540-3-0x000000001C170000-0x000000001C63E000-memory.dmp

Download

memory/2540-2-0x00007FF9CAC70000-0x00007FF9CB6A8000-memory.dmp

Download

memory/2540-1-0x000000001BBF0000-0x000000001BC96000-memory.dmp

Download

memory/2680-480-0x000000001C130000-0x000000001C2D4000-memory.dmp

Download

memory/2724-444-0x000000001C750000-0x000000001C8F4000-memory.dmp

Download

memory/2920-651-0x000000001C030000-0x000000001C1D4000-memory.dmp

Download

memory/2944-786-0x000000001BEA0000-0x000000001C044000-memory.dmp

Download

memory/2948-399-0x000000001BE60000-0x000000001C004000-memory.dmp

Download

memory/3024-336-0x000000001C320000-0x000000001C4C4000-memory.dmp

Download

memory/3080-264-0x000000001C9D0000-0x000000001CB74000-memory.dmp

Download

memory/3108-417-0x000000001C520000-0x000000001C6C4000-memory.dmp

Download

memory/3148-831-0x000000001C050000-0x000000001C1F4000-memory.dmp

Download

memory/3220-741-0x000000001CCD0000-0x000000001CE74000-memory.dmp

Download

memory/3328-489-0x000000001C350000-0x000000001C4F4000-memory.dmp

Download

memory/3336-552-0x000000001CA90000-0x000000001CC34000-memory.dmp

Download

memory/3432-38-0x000000001C320000-0x000000001C4C4000-memory.dmp

Download

memory/3432-27-0x00007FF9CAC70000-0x00007FF9CB6A8000-memory.dmp

Download

memory/3432-39-0x00007FF9CAC70000-0x00007FF9CB6A8000-memory.dmp

Download

memory/3440-354-0x000000001C240000-0x000000001C3E4000-memory.dmp

Download

memory/3444-777-0x000000001C9B0000-0x000000001CB54000-memory.dmp

Download

memory/3468-345-0x000000001C1B0000-0x000000001C354000-memory.dmp

Download

memory/3484-81-0x000000001C7A0000-0x000000001C944000-memory.dmp

Download

memory/3508-381-0x000000001C980000-0x000000001CB24000-memory.dmp

Download

memory/3564-606-0x000000001CEB0000-0x000000001D054000-memory.dmp

Download

memory/3588-219-0x000000001C880000-0x000000001CA24000-memory.dmp

Download

memory/3992-795-0x000000001BEE0000-0x000000001C084000-memory.dmp

Download

memory/4100-759-0x000000001BFC0000-0x000000001C164000-memory.dmp

Download

memory/4168-660-0x000000001C820000-0x000000001C9C4000-memory.dmp

Download

memory/4364-372-0x000000001C9B0000-0x000000001CB54000-memory.dmp

Download

memory/4532-705-0x000000001C2B0000-0x000000001C454000-memory.dmp

Download

memory/4544-633-0x000000001CBB0000-0x000000001CD54000-memory.dmp

Download

memory/4720-390-0x000000001CB80000-0x000000001CD24000-memory.dmp

Download

memory/4760-228-0x000000001C9B0000-0x000000001CB54000-memory.dmp

Download

memory/4772-237-0x000000001C280000-0x000000001C424000-memory.dmp

Download

memory/4840-462-0x000000001C080000-0x000000001C224000-memory.dmp

Download

memory/4852-579-0x000000001C580000-0x000000001C724000-memory.dmp

Download

memory/4916-813-0x000000001C6F0000-0x000000001C894000-memory.dmp

Download

memory/4932-408-0x000000001C660000-0x000000001C804000-memory.dmp

Download

memory/4948-723-0x000000001BEF0000-0x000000001C094000-memory.dmp

Download

memory/4988-123-0x000000001C8D0000-0x000000001CA74000-memory.dmp

Download

memory/5056-543-0x000000001C770000-0x000000001C914000-memory.dmp

Download

memory/5088-426-0x000000001C340000-0x000000001C4E4000-memory.dmp

Download

memory/5152-525-0x000000001C6B0000-0x000000001C854000-memory.dmp

Download

memory/5156-165-0x000000001CD00000-0x000000001CEA4000-memory.dmp

Download

memory/5168-109-0x000000001C3A0000-0x000000001C544000-memory.dmp

Download

memory/5492-273-0x000000001BF50000-0x000000001C0F4000-memory.dmp

Download

memory/5580-210-0x000000001C320000-0x000000001C4C4000-memory.dmp

Download

memory/5624-804-0x000000001BDC0000-0x000000001BF64000-memory.dmp

Download

memory/5652-768-0x000000001BE10000-0x000000001BFB4000-memory.dmp

Download

memory/5716-291-0x000000001C2B0000-0x000000001C454000-memory.dmp

Download

memory/5740-53-0x000000001CB30000-0x000000001CCD4000-memory.dmp

Download

memory/5772-95-0x000000001C8F0000-0x000000001CA94000-memory.dmp

Download

memory/5800-714-0x000000001BE30000-0x000000001BFD4000-memory.dmp

Download

memory/5828-588-0x000000001C890000-0x000000001CA34000-memory.dmp

Download

memory/5832-516-0x000000001C000000-0x000000001C1A4000-memory.dmp

Download

memory/5836-507-0x000000001BEE0000-0x000000001C084000-memory.dmp

Download

memory/5916-327-0x000000001BDA0000-0x000000001BF44000-memory.dmp

Download

memory/5960-246-0x000000001C580000-0x000000001C724000-memory.dmp

Download

memory/5980-669-0x000000001C110000-0x000000001C2B4000-memory.dmp

Download

memory/6068-561-0x000000001C240000-0x000000001C3E4000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads